Security advisories

medium2026-03-26

CVE-2026-33726-Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic

cilium/cilium · GHSA-hxv8-4j4r-cqgv

critical2026-03-26

CVE-2026-33728-dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution

datadog/dd-trace-java · GHSA-579q-h82j-r5v2

high2026-03-26

CVE-2026-33713-n8n has SQL Injection in Data Table Node via orderByColumn Expression

n8n-io/n8n · GHSA-98c2-4cr3-4jc3

critical2026-03-26

CVE-2026-33696-n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE

n8n-io/n8n · GHSA-mxrg-77hm-89hv

medium2026-03-26

CVE-2026-4274-Mattermost has an Incorrect Authorization issue

mattermost/mattermost · GHSA-g7fp-cqj5-x8hf

low2026-03-26

CVE-2026-4874-Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation

keycloak/keycloak · GHSA-22rm-wp4x-v5cx

high2026-03-26

CVE-2026-33744-BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

bentoml/bentoml · GHSA-jfjg-vc52-wqvf

medium2026-03-25

CVE-2026-33724-n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no

n8n-io/n8n · GHSA-43v7-fp2v-68f6

high2026-03-25

CVE-2026-33722-n8n Has External Secrets Authorization Bypass in Credential Saving

n8n-io/n8n · GHSA-fxcw-h3qj-8m8p

medium2026-03-25

CVE-2026-33183-Saloon has a Fixture Name Path Traversal Vulnerability

saloonphp/saloon · GHSA-f7xc-5852-fj99

medium2026-03-25

CVE-2026-33182-Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL

saloonphp/saloon · GHSA-c83f-3xp6-hfcp

medium2026-03-25

CVE-2026-33720-n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK

n8n-io/n8n · GHSA-vpgc-2f6g-7w7x

high2026-03-25

CVE-2026-33723-AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter

wwbn/avideo · GHSA-ffr8-fxhv-fv8h

high2026-03-25

CVE-2026-33719-AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment

wwbn/avideo · GHSA-r64r-883r-wcwh

high2026-03-25

CVE-2026-33718-OpenHands is Vulnerable to Command Injection through its Git Diff Handler

openhands/openhands · GHSA-7h8w-hj9j-8rjw

high2026-03-25

CVE-2025-70887-Signify allows a remote attacker to escalate privileges via the signed_data.py and the context.py components

ralphje/signify · GHSA-p4hh-mq57-gq8x

high2026-03-25

CVE-2025-70952-pf4j is vulnerable to Path Traversal or Zip Slip attack through improper handling of zip entry names

pf4j/pf4j · GHSA-5458-7hh9-v7p4

high2026-03-25

CVE-2026-33717-AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL

wwbn/avideo · GHSA-8wf4-c4x3-h952

critical2026-03-25

CVE-2026-33716-AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php

wwbn/avideo · GHSA-9hv9-gvwm-95f2

critical2026-03-25

CVE-2026-33701-OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

open-telemetry/opentelemetry-java-instrumentation · GHSA-xw7x-h9fj-p2c7