Security advisories

high2026-03-18

CVE-2026-32763-SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.

kysely-org/kysely · GHSA-wmrf-hv6w-mr66

medium2026-03-18

CVE-2026-32761-File Browser has an Authorization Policy Bypass in Public Share Download Flow

filebrowser/filebrowser · GHSA-68j5-4m99-w9w9

medium2026-03-18

Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121

argoproj-labs/terraform-provider-argocd · GHSA-594f-3595-c47v

high2026-03-18

CVE-2026-33053-Langflow is Missing Ownership Verification in API Key Deletion (IDOR)

langflow-ai/langflow · GHSA-rf6x-r45m-xv3w

medium2026-03-18

CVE-2026-33051-Craft CMS Vulnerable to Stored XSS in Revision Context Menu

craftcms/cms · GHSA-3x4w-mxpf-fhqq

medium2026-03-18

CVE-2026-1217-Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite

yoast-dist/duplicate-post · GHSA-g9w4-m5fx-x3wv

high2026-03-18

CVE-2026-22730-SQL Injection in Spring AI MariaDBFilterExpressionConverter

spring-projects/spring-ai · GHSA-c267-rfvc-mvpm

high2026-03-18

CVE-2026-22729-JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter

spring-projects/spring-ai · GHSA-rp9g-qx29-88cp

medium2026-03-18

CVE-2026-2575-Keycloak: Denial of Service due to excessive SAMLRequest decompression

keycloak/keycloak · GHSA-xv6h-r36f-3gp5

high2026-03-18

CVE-2026-2603-Keycloak: Unauthorized authentication via disabled SAML Identity Provider

keycloak/keycloak · GHSA-x4p7-7chp-64hq

high2026-03-17

CVE-2026-32981-Ray Dashboard is vulnerable to path traversal through its static file handling mechanism

ray-project/ray · GHSA-j3mh-qmjj-xp83

medium2026-03-17

CVE-2026-4269-Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit

aws/bedrock-agentcore-starter-toolkit · GHSA-xfhr-q72q-jcrj

medium2026-03-17

CVE-2026-4270-AWS API MCP File Access Restriction Bypass

awslabs/mcp · GHSA-2cpp-j2fc-qhp7

high2026-03-17

CVE-2026-33039-AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

wwbn/avideo · GHSA-9x67-f2v7-63rw

medium2026-03-17

CVE-2026-33035-Unauthenticated Reflected XSS via innerHTML in AVideo

wwbn/avideo · GHSA-wfq5-qgqp-hvhv

critical2026-03-17

CVE-2026-33017-Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

langflow-ai/langflow · GHSA-vwmf-pq79-vjvx

high2026-03-17

CVE-2026-32256-music-metadata has an infinite loop vulnerability in ASF parser

borewit/music-metadata · GHSA-v6c2-xwv6-8xf7

high2026-03-17

CVE-2026-33043-AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS

wwbn/avideo · GHSA-qc3p-398r-p59j

medium2026-03-17

CVE-2026-33042-Parse Server affected by empty authData bypassing credential requirement on signup

parse-community/parse-server · GHSA-wjqw-r9x4-j59v

medium2026-03-17

CVE-2026-32766-astral-tokio-tar insufficiently validates PAX extensions during extraction

astral-sh/tokio-tar · GHSA-6gx3-4362-rf54