Security advisories

medium2026-02-28

CVE-2026-18401-jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition

fasterxml/jackson-core · GHSA-72hv-8253-57qq

critical2026-02-28

CVE-2026-28268-Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse

go-vikunja/vikunja · GHSA-rfjg-6m84-crj2

medium2026-02-27

CVE-2026-28208-Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix

junrar/junrar · GHSA-j273-m5qq-6825

medium2026-02-27

CVE-2026-32898-OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata

openclaw/openclaw · GHSA-7jx5-9fjg-hp4m

medium2026-02-27

CVE-2026-4039-OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)

openclaw/openclaw · GHSA-82g8-464f-2mv7

high2026-02-27

CVE-2026-27939-Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

statamic/cms · GHSA-rw9x-pxqx-q789

low2026-02-27

CVE-2026-27945-ZITADEL has potential SSRF via Actions

zitadel/zitadel · GHSA-7777-fhq9-592v

high2026-02-27

CVE-2026-27946-ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API

zitadel/zitadel · GHSA-282g-fhmx-xf54

medium2026-02-27

CVE-2026-27840-ZITADEL's truncated opaque tokens are still valid

zitadel/zitadel · GHSA-6mq3-xmgp-pjm5

high2026-02-27

CVE-2026-27836-phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint

thorsten/phpmyfaq · GHSA-w22q-m2fm-x9f4

medium2026-02-27

CVE-2026-27734-Beszel: Docker API has a Path Traversal Vulnerability via Unsanitized Container ID

henrygd/beszel · GHSA-phwh-4f42-gwf3

medium2026-02-27

CVE-2026-27638-@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

actualbudget/actual · GHSA-qmjj-p7m9-wjrv

high2026-02-27

CVE-2026-27449-Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints

umbraco/umbraco.engage.issues · GHSA-86vq-ccwf-rm62

high2026-02-27

CVE-2026-27970-Angular i18n vulnerable to Cross-Site Scripting

angular/angular · GHSA-prjf-86w9-mfqv

high2026-02-27

CVE-2026-26862-CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage

clevertap/clevertap-web-sdk · GHSA-jfrq-hj9f-c8qx

high2026-02-27

CVE-2026-26861-CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function

clevertap/clevertap-web-sdk · GHSA-j5mf-6rh3-rhgg

critical2026-02-27

CVE-2026-27969-Vitess users with backup storage access can write to arbitrary file paths on restore

vitessio/vitess · GHSA-r492-hjgh-c9gw

medium2026-02-27

AWS CLI: cli_history database does not restrict file permissions on Unix systems

aws/aws-cli · GHSA-747p-wmpv-9c78

critical2026-02-27

CVE-2026-27966-Langflow has Remote Code Execution in CSV Agent

langflow-ai/langflow · GHSA-3645-fxcv-hqr4

medium2026-02-27

CVE-2025-13327-uv has ZIP payload obfuscation through parsing differentials

astral-sh/uv · GHSA-v653-r55g-hcmg