Security advisories

medium2026-02-27

CVE-2026-0871-Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes

keycloak/keycloak · GHSA-v4jw-m6rm-399h

high2026-02-27

CVE-2026-0980-rubyipmi is vulnerable to OS Command Injection through malicious usernames

logicminds/rubyipmi · GHSA-hfcp-477w-3wjw

low2026-02-27

CVE-2025-12150-Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass

keycloak/keycloak · GHSA-7g5x-9c4v-4w5r

low2026-02-27

CVE-2026-3293-Snowflake JDBC Driver is Vulnerable to Uncontrolled Resource Consumption through SdkProxyRoutePlanner

snowflakedb/snowflake-jdbc · GHSA-gx6c-pv62-9mcf

critical2026-02-27

CVE-2026-28370-OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection

openstack/vitrage · GHSA-8xwf-cr4r-856r

critical2026-02-27

CVE-2026-28363-OpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode

openclaw/openclaw · GHSA-7977-c43c-xpwj

low2026-02-27

CVE-2026-3269-PSI Probe: Broken access control can lead to DoS

psi-probe/psi-probe · GHSA-rx6w-2w6h-r346

low2026-02-27

CVE-2026-3270-PSI Probe vulnerable to Server-Side Request Forgery

psi-probe/psi-probe · GHSA-429m-9874-rx9w

high2026-02-26

CVE-2026-27965-Vitess users with backup storage access can gain unauthorized access to production deployment environments

vitessio/vitess · GHSA-8g8j-r87h-p36x

medium2026-02-26

CVE-2026-22728-Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations

bitnami-labs/sealed-secrets · GHSA-465p-v42x-3fmj

high2026-02-26

Curio exposes database credentials to users with network access through verbose HTTP error responses

filecoin-project/curio · GHSA-gj6x-q8rh-wj6x

medium2026-02-26

n8n has Webhook Forgery on Zendesk Trigger Node

n8n-io/n8n · GHSA-38c7-23hj-2wgq

medium2026-02-26

n8n has a Guardrail Node Bypass

n8n-io/n8n · GHSA-fvfv-ppw4-7h2w

medium2026-02-26

n8n has an Authentication Bypass in its Chat Trigger Node

n8n-io/n8n · GHSA-jh8h-6c9q-7gmw

medium2026-02-26

n8n has an SSO Enforcement Bypass in its Self-Service Settings API

n8n-io/n8n · GHSA-vjf3-2gpj-233v

high2026-02-26

CVE-2026-27959-Koa has Host Header Injection via ctx.hostname

koajs/koa · GHSA-7gcc-r8m5-44qm

medium2026-02-26

CVE-2026-27948-Copyparty vulnerable to reflected XSS via setck parameter

9001/copyparty · GHSA-62cr-6wp5-q43h

low2026-02-26

CVE-2026-27942-fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

naturalintelligence/fast-xml-parser · GHSA-fj3w-jwp8-x2g3

medium2026-02-26

CVE-2026-27902-Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

sveltejs/svelte · GHSA-qgvg-pr8v-6rr3

medium2026-02-26

CVE-2026-27901-Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

sveltejs/svelte · GHSA-phwv-c562-gvmh