Security advisories

medium2026-03-16

CVE-2026-25783-Mattermost fails to properly validate User-Agent header tokens

mattermost/mattermost · GHSA-2v3w-6g35-5f9v

high2026-03-16

CVE-2025-14287-MLflow has a command injection in mlflow/sagemaker/__init__.py

mlflow/mlflow · GHSA-xch3-2f9x-wh9f

high2026-03-16

CVE-2025-54920-Apache Spark: Spark History Server Code Execution Vulnerability

apache/spark · GHSA-jwp6-cvj8-fw65

high2026-03-16

CVE-2026-28490-Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

authlib/authlib · GHSA-7432-952r-cw78

critical2026-03-16

CVE-2026-27962-Authlib JWS JWK Header Injection: Signature Verification Bypass

authlib/authlib · GHSA-wvwj-cvrp-7pv5

low2026-03-16

CVE-2026-27448-pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

pyca/pyopenssl · GHSA-vp96-hxj8-p424

critical2026-03-16

CVE-2026-25534-Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames

spinnaker/spinnaker · GHSA-8r8j-gfhg-fw38

high2026-03-16

CVE-2025-69196-FastMCP OAuth Proxy token reuse across MCP servers

prefecthq/fastmcp · GHSA-5h2m-4q8j-pqpj

medium2026-03-13

CVE-2025-60012-Apache Livy: Restrict file access

apache/incubator-livy · GHSA-hm8x-rpgg-7855

medium2026-03-13

CVE-2025-66249-Apache Livy: Unauthorized directory access

apache/incubator-livy · GHSA-h84f-4ff9-8hc3

high2026-03-13

CVE-2026-32720-github.com/ctfer-io/monitoring Vulnerable to Improper Access Control

ctfer-io/monitoring · GHSA-7x23-j8gv-v54x

medium2026-03-13

fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`

trailofbits/fickling · GHSA-5cxw-w2xg-2m8h

medium2026-03-13

fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist

trailofbits/fickling · GHSA-r48f-3986-4f9c

high2026-03-13

CVE-2026-4092-@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script

google/clasp · GHSA-hqjg-pww4-pcgq

high2026-03-13

CVE-2026-32933-AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion

luckypennysoftware/automapper · GHSA-rvv3-g6hj-g44x

medium2026-03-13

CVE-2026-32704-SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB

siyuan-note/siyuan · GHSA-4j3x-hhg2-fm2x

high2026-03-13

CVE-2026-32640-SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox

danthedeckie/simpleeval · GHSA-44vg-5wv2-h2hg

high2026-03-13

CVE-2026-32635-Angular vulnerable to XSS in i18n attribute bindings

angular/angular · GHSA-g93w-mfhg-p222

medium2026-03-13

CVE-2026-32630-file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry

sindresorhus/file-type · GHSA-j47w-4g3g-c36v

medium2026-03-13

CVE-2026-34505-OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation

openclaw/openclaw · GHSA-5m9r-p9g7-679c