Security advisories

critical2026-02-23

CVE-2026-23552-Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

apache/camel · GHSA-c3f3-cc42-xr9v

high2026-02-23

CVE-2026-25747-Apache Camel Deserializes Untrusted Data in its LevelDB Component

apache/camel · GHSA-429q-mrc4-38fr

low2026-02-23

CVE-2026-2969-datapizza-ai: Server-Side Template Injection in ChatPromptTemplate via Jinja2 Template Handler

datapizza-labs/datapizza-ai · GHSA-q5xx-fxv3-xxqf

low2026-02-23

CVE-2026-2970-datapizza-ai has unsafe deserialization via pickle.loads() in RedisCache

datapizza-labs/datapizza-ai · GHSA-hg58-x52p-859c

low2026-02-22

CVE-2026-2897-funadmin: XSS through Value argument in Backend Interface component

funadmin/funadmin · GHSA-rfh7-7v27-6p9r

low2026-02-22

CVE-2026-2898-funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function

funadmin/funadmin · GHSA-gcxp-xg77-798j

low2026-02-22

CVE-2026-2895-funadmin has Weak Password Recovery Mechanism for Forgotten Password

funadmin/funadmin · GHSA-fmr2-m7gc-577w

medium2026-02-22

CVE-2026-2894-funadmin exposes sensitive information via getMember function

funadmin/funadmin · GHSA-8hhx-xq9j-xwfj

medium2026-02-22

CVE-2026-2896-funadmin has Incorrect Privilege Assignment in its Configuration Handler

funadmin/funadmin · GHSA-5m2g-4cf6-c3rg

high2026-02-21

CVE-2026-26045-Moodle has a Remote Code Execution risk via file restore

moodle/moodle · GHSA-ggxq-2mg9-8966

medium2026-02-21

CVE-2026-26047-Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits

moodle/moodle · GHSA-cg8j-5cr2-568q

medium2026-02-21

CVE-2025-65995-Apache Airflow error reporting may expose full kwargs

apache/airflow · GHSA-gfw7-2v73-69wg

high2026-02-21

CVE-2026-2033-MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability

mlflow/mlflow · GHSA-q2r8-vmq7-fpx2

critical2026-02-21

CVE-2026-2635-MLflow Use of Default Password Authentication Bypass Vulnerability

mlflow/mlflow · GHSA-gq3w-7jj3-x7gr

medium2026-02-20

CVE-2026-27576-OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs

openclaw/openclaw · GHSA-cxpw-2g23-2vgw

high2026-02-20

CVE-2026-2473-Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming

googleapis/python-aiplatform · GHSA-wh2j-26j7-9728

high2026-02-20

CVE-2026-2472-Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)

googleapis/python-aiplatform · GHSA-qv8j-hgpc-vrq8

medium2026-02-20

CVE-2026-27482-Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)

ray-project/ray · GHSA-q5fh-2hc8-f6rq

medium2026-02-20

CVE-2026-27568-AVideo has Stored Cross-Site Scripting via Markdown Comment Injection

wwbn/avideo · GHSA-rcqw-6466-3mv7

medium2026-02-20

CVE-2026-27492-Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused

lettermint/lettermint-node · GHSA-49pc-8936-wvfp