Security advisories

high2026-02-18

CVE-2026-27001-OpenClaw: Unsanitized CWD path injection into LLM prompts

openclaw/openclaw · GHSA-2qj5-gwg2-xwc4

high2026-02-18

CVE-2026-1669-Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading

keras-team/keras · GHSA-3m4q-jmj6-r34q

medium2026-02-18

CVE-2026-27026-pypdf possibly has long runtimes for malformed FlateDecode streams

py-pdf/pypdf · GHSA-9mvc-8737-8j8h

medium2026-02-18

CVE-2026-27025-pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

py-pdf/pypdf · GHSA-wgvp-vg3v-2xq3

medium2026-02-18

CVE-2026-27024-pypdf has a possible infinite loop when processing TreeObject

py-pdf/pypdf · GHSA-996q-pr4m-cvgq

medium2026-02-18

CVE-2026-27022-RediSearch Query Injection in @langchain/langgraph-checkpoint-redis

langchain-ai/langgraphjs · GHSA-5mx2-w598-339m

high2026-02-18

CVE-2026-26996-minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

isaacs/minimatch · GHSA-3ppc-4f35-3m26

low2026-02-18

CVE-2026-26958-filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity

filosottile/edwards25519 · GHSA-fw7p-63qq-7hpr

high2026-02-18

CVE-2026-26318-Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation

sebhildebrandt/systeminformation · GHSA-5vv4-hvf7-2h46

medium2026-02-18

CVE-2026-26315-Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake

ethereum/go-ethereum · GHSA-m6j8-rg6r-7mv8

high2026-02-18

CVE-2026-26314-Go Ethereum affected by DoS via malicious p2p message

ethereum/go-ethereum · GHSA-2gjw-fg97-vg3r

medium2026-02-18

CVE-2026-26313-Go Ethereum affected by DoS via malicious p2p message

ethereum/go-ethereum · GHSA-689v-6xwf-5jf3

low2026-02-18

CVE-2026-26995-uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120

refraction-networking/utls · GHSA-rrxv-pmq9-x67r

low2026-02-18

CVE-2026-27017-uTLS has a fingerprint vulnerability from GREASE ECH mismatch for Chrome parrots

refraction-networking/utls · GHSA-7m29-f4hw-g2vx

high2026-02-18

CVE-2026-26990-LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php

librenms/librenms · GHSA-79q9-wc6p-cf92

medium2026-02-18

CVE-2026-26989-LibreNMS has a Stored XSS in Alert Rule

librenms/librenms · GHSA-6xmx-xr9p-58p7

high2026-02-18

CVE-2026-26988-LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream.

librenms/librenms · GHSA-h3rv-q4rq-pqcv

medium2026-02-18

CVE-2026-27016-LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags()

librenms/librenms · GHSA-fqx6-693c-f55g

medium2026-02-18

CVE-2026-26992-LibreNMS /port-groups name Stored Cross-Site Scripting

librenms/librenms · GHSA-93fx-g747-695x

medium2026-02-18

CVE-2026-26991-LibreNMS /device-groups name Stored Cross-Site Scripting

librenms/librenms · GHSA-5pqf-54qp-32wx