Security advisories

high2026-02-19

CVE-2026-25940-jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)

parallax/jspdf · GHSA-p5xg-68wr-hm3m

high2026-02-19

CVE-2026-25755-jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method

parallax/jspdf · GHSA-9vjf-qc39-jprp

critical2026-02-19

CVE-2025-13590-carbon-apimgt does not properly restrict uploaded files

wso2/carbon-apimgt · GHSA-p6jf-79j3-33f3

low2026-02-19

CVE-2026-2733-Keycloak: Missing Check on Disabled Client for Docker Registry Protocol

keycloak/keycloak · GHSA-fjf4-6f34-w64q

medium2026-02-19

CVE-2026-24834-Kata Container to Guest micro VM privilege escalation

kata-containers/kata-containers · GHSA-wwj6-vghv-5p64

high2026-02-19

CVE-2026-25535-jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

parallax/jspdf · GHSA-67pg-wm7f-q7fj

medium2026-02-19

CVE-2026-27122-Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

sveltejs/svelte · GHSA-m56q-vw4c-c2cp

medium2026-02-19

CVE-2026-27121-Svelte affected by cross-site scripting via spread attributes in Svelte SSR

sveltejs/svelte · GHSA-f7gr-6p89-r883

medium2026-02-19

CVE-2026-27119-Svelte affected by XSS in SSR `<option>` element

sveltejs/svelte · GHSA-h7h7-mm68-gmrc

medium2026-02-19

CVE-2026-27118-Cache poisoning in @sveltejs/adapter-vercel

sveltejs/kit · GHSA-9pq4-5hcf-288c

low2026-02-19

Unsoundness in opt-in ARMv8 assembly backend for `keccak`

rustcrypto/sponges · GHSA-3288-p39f-rqpv

critical2026-02-19

CVE-2026-27112-Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints

akuity/kargo · GHSA-7g9x-cp9g-92mr

medium2026-02-19

CVE-2026-27111-Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints

akuity/kargo · GHSA-5vvm-67pj-72g4

high2026-02-18

CVE-2026-27013-Fabric.js Affected by Stored XSS via SVG Export

fabricjs/fabric.js · GHSA-hfvx-25r5-qc3w

medium2026-02-18

CVE-2026-27009-OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection

openclaw/openclaw · GHSA-37gc-85xm-2ww6

medium2026-02-18

CVE-2026-27008-OpenClaw hardened the skill download target directory validation

openclaw/openclaw · GHSA-h7f7-89mm-pqh6

medium2026-02-18

CVE-2026-27007-OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation

openclaw/openclaw · GHSA-xxvh-5hwj-42pp

medium2026-02-18

CVE-2026-27004-OpenClaw session tool visibility hardening and Telegram webhook secret fallback

openclaw/openclaw · GHSA-6hf3-mhgc-cm65

medium2026-02-18

CVE-2026-27003-OpenClaw: Telegram bot token exposure via logs

openclaw/openclaw · GHSA-chf7-jq6g-qrwv

high2026-02-18

CVE-2026-27002-OpenClaw: Docker container escape via unvalidated bind mount config injection

openclaw/openclaw · GHSA-w235-x559-36mg