Security advisories

low2026-02-24

CVE-2026-23983-Apache Superset allows authenticated users to view sensitive data without explicit permissions

apache/superset · GHSA-h294-8fxm-m2pj

medium2026-02-24

CVE-2026-23980-Apache Superset allows privileged users to conduct error-based SQL Injection

apache/superset · GHSA-gvxg-9hqx-f4rg

medium2026-02-24

CVE-2026-23969-Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine

apache/superset · GHSA-48m2-v2r8-h23m

high2026-02-24

CVE-2026-23982-Apache Superset Improper Authorization allows low-privileged users to bypass access controls

apache/superset · GHSA-3m2g-v7jf-7fxc

medium2026-02-24

CVE-2026-25637-ImageMagick: Possible memory leak in ASHLAR encoder

imagemagick/imagemagick · GHSA-gm37-qx7w-p258

medium2026-02-24

CVE-2026-25576-ImageMagick: Out of bounds read in multiple coders read raw pixel data

imagemagick/imagemagick · GHSA-jv4p-gjwq-9r2j

high2026-02-24

CVE-2026-24485-ImageMagick: Infinite loop vulnerability when parsing a PCD file

imagemagick/imagemagick · GHSA-pqgj-2p96-rx85

medium2026-02-24

CVE-2026-24484-ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

imagemagick/imagemagick · GHSA-wg3g-gvx5-2pmv

high2026-02-24

CVE-2026-24481-ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

imagemagick/imagemagick · GHSA-96pc-27rx-pr36

high2026-02-24

CVE-2024-56373-Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table

apache/airflow · GHSA-r837-hpv7-pc2f

medium2026-02-24

CVE-2025-27555-Apache Airflow exposes sensitive information in its log files

apache/airflow · GHSA-8r55-rv5w-6pfm

medium2026-02-23

CVE-2026-27128-Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit

craftcms/cms · GHSA-6fx5-5cw5-4897

high2026-02-23

CVE-2026-27127-Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding

craftcms/cms · GHSA-gp2f-7wcm-5fhx

medium2026-02-23

CVE-2026-27126-Craft CMS has Stored XSS in Table Field via "HTML" Column Type

craftcms/cms · GHSA-3jh3-prx3-w6wc

high2026-02-23

CVE-2026-26331-yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

yt-dlp/yt-dlp · GHSA-g3gw-q23r-pgqm

critical2026-02-23

CVE-2026-26198-ormar is vulnerable to SQL Injection through aggregate functions min() and max()

collerek/ormar · GHSA-xxh2-68g9-8jqr

high2026-02-23

CVE-2026-25802-New API has Potential XSS in its MarkdownRenderer component

quantumnous/new-api · GHSA-299v-8pq9-5gjq

high2026-02-23

CVE-2026-25591-New API has an SQL LIKE Wildcard Injection DoS via Token Search

quantumnous/new-api · GHSA-w6x6-9fp7-fqm4

medium2026-02-23

CVE-2026-25545-Astro has Full-Read SSRF in error rendering via Host: header injection

withastro/astro · GHSA-qq67-mvv5-fw3g

high2026-02-23

CVE-2025-70058-yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent

ymfe/yapi · GHSA-663h-2vr3-ghrj