Security advisories

high2026-03-05

SageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality

aws/sagemaker-python-sdk · GHSA-5r2p-pjr8-7fh7

medium2026-03-05

Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint

flowiseai/flowise · GHSA-jc5m-wrp2-qq38

medium2026-03-05

CVE-2026-56272-Flowise has Insufficient Password Salt Rounds

flowiseai/flowise · GHSA-x2g5-fvc2-gqvp

medium2026-03-05

CVE-2026-30227-MimeKit has CRLF Injection in Quoted Local-Part that Enables SMTP Command Injection and Email Forgery

jstedfast/mimekit · GHSA-g7hc-96xr-gvvx

medium2026-03-05

CVE-2026-30247-WeKnora is Vulnerable to SSRF via Redirection

tencent/weknora · GHSA-595m-wc8g-6qgc

high2026-03-05

CVE-2026-30244-Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure

makeplane/plane · GHSA-87x4-j8vh-p5qf

high2026-03-05

CVE-2026-30242-Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer

makeplane/plane · GHSA-fpx8-73gf-7x73

medium2026-03-05

CVE-2026-29787-mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint

doobidoo/mcp-memory-service · GHSA-73hc-m4hx-79pj

low2026-03-05

CVE-2025-11143-org.eclipse.jetty:jetty-http has different parsing of invalid URIs

jetty/jetty.project · GHSA-wjpw-4j6x-6rwh

medium2026-03-05

CVE-2025-70948-@perfood/couch-auth has a host header injection vulnerability

perfood/couch-auth · GHSA-qw8v-34ww-6q9p

high2026-03-05

CVE-2025-70949-@perfood/couch-auth has an Observable Timing Discrepancy

perfood/couch-auth · GHSA-mjqr-5c55-g77h

medium2026-03-05

CVE-2026-22723-Cloudfoundry UAA has logic error in the token revocation endpoint implementation

cloudfoundry/uaa · GHSA-6wcw-r64p-qrrw

high2026-03-05

CVE-2026-3009-Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator

keycloak/keycloak · GHSA-m297-3jv9-m927

medium2026-03-05

CVE-2024-43035-Fonoster is vulnerable to directory traversal

fonoster/fonoster · GHSA-9fv2-c7v6-p45w

high2026-03-05

CVE-2026-3047-Keycloak SAML Broken has Authentication Bypass by Primary Weakness

keycloak/keycloak · GHSA-8cr3-vpxx-92cx

high2026-03-05

CVE-2025-45691-RAGAS has an Arbitrary File Read vulnerability

vibrantlabsai/ragas · GHSA-v2xr-wvrv-p969

medium2026-03-05

CVE-2026-3419-Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

fastify/fastify · GHSA-573f-x89g-hqp9

high2026-03-05

CVE-2026-1605-The Eclipse Jetty Server Artifact has a Gzip request memory leak

jetty/jetty.project · GHSA-xxh7-fcf3-rj7f

medium2026-03-05

CVE-2026-30233-OliveTin doesn't check view permission when returning dashboards

olivetin/olivetin · GHSA-jf73-858c-54pg

medium2026-03-05

EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface

ec-cube/ec-cube · GHSA-7rhv-h82h-vpjh