Security advisories

high2026-02-19

CVE-2026-27192-Feathers has an origin validation bypass via prefix matching

feathersjs/feathers · GHSA-mp4x-c34x-wv3x

high2026-02-19

CVE-2026-27191-Feathers has an open redirect in OAuth callback enables account takeover

feathersjs/feathers · GHSA-ppf9-4ffw-hh4p

high2026-02-19

CVE-2026-27190-Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

denoland/deno · GHSA-hmh4-3xvx-q5hr

high2026-02-19

CVE-2026-27198-Formwork Improperly Managed Privileges in User creation

getformwork/formwork · GHSA-34p4-7w83-35g2

high2026-02-19

CVE-2026-27196-Statamic affected by privilege escalation via stored cross-site scripting

statamic/cms · GHSA-8r7r-f4gm-wcpq

medium2026-02-19

CPU exhaustion in SvelteKit remote form deserialization (experimental only)

sveltejs/kit · GHSA-88qp-p4qg-rqm6

medium2026-02-19

Memory exhaustion in SvelteKit remote form deserialization (experimental only)

sveltejs/kit · GHSA-vrhm-gvg7-fpcf

low2026-02-19

devalue affected by CPU and memory amplification from sparse arrays

sveltejs/devalue · GHSA-33hq-fvwr-56pm

low2026-02-19

devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed

sveltejs/devalue · GHSA-8qm3-746x-r74r

high2026-02-19

CVE-2026-27194-D-Tale affected by Remote Code Execution through the /save-column-filter endpoint

man-group/dtale · GHSA-c87c-78rc-vmv2

medium2026-02-19

CVE-2026-27125-Svelte SSR attribute spreading includes inherited properties from prototype chain

sveltejs/svelte · GHSA-crpf-4hrx-3jrp

critical2026-02-19

CVE-2026-27212-Prototype pollution in swiper

nolimits4web/swiper · GHSA-hmx5-qpq5-p643

high2026-02-19

CVE-2026-27203-eBay API MCP Server Affected by Environment Variable Injection

yosefhayim/ebay-mcp · GHSA-97rm-xj73-33jh

high2026-02-19

PyO3 has type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature

pyo3/pyo3 · GHSA-47qc-857f-7w7f

low2026-02-19

Hono added timing comparison hardening in basicAuth and bearerAuth

honojs/hono · GHSA-gq3j-xvxp-8hrf

high2026-02-19

CVE-2026-28479-OpenClaw replaced a deprecated sandbox hash algorithm

openclaw/openclaw · GHSA-fh3f-q9qw-93j9

medium2026-02-19

CVE-2026-28394-OpenClaw has a Web Fetch DoS via unbounded response parsing

openclaw/openclaw · GHSA-p536-vvpp-9mc8

medium2026-02-19

CVE-2026-27120-Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster

vapor/leaf-kit · GHSA-4hfh-fch3-5q7p

medium2026-02-19

CVE-2026-26963-Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled

cilium/cilium · GHSA-5r23-prx4-mqg3

critical2026-02-19

CVE-2026-26030-Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

microsoft/semantic-kernel · GHSA-xjw9-4gw8-4rqx