Security advisories

medium2026-02-18

CVE-2026-26987-LibreNMS affected by reflected xss via email field

librenms/librenms · GHSA-gqx7-99jw-6fpr

medium2026-02-18

CVE-2026-79772-Nokogiri does not check the return value from xmlC14NExecute

sparklemotion/nokogiri · GHSA-wx95-c6cv-8532

high2026-02-18

CVE-2026-26280-Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path

sebhildebrandt/systeminformation · GHSA-9c88-49p5-5ggf

critical2026-02-18

CVE-2026-26980-Ghost has a SQL injection in Content API

tryghost/ghost · GHSA-w52v-v783-gw97

high2026-02-18

CVE-2026-26974-Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde

tygo-van-den-hurk/slyde · GHSA-w7h5-55jg-cq2f

low2026-02-18

CVE-2026-2666-mingSoft MCMS does not properly restrict file uploads

ming-soft/mcms · GHSA-r9wp-qq53-qvjx

high2026-02-18

CVE-2026-24708-OpenStack Nova calls qemu-img without format restrictions for resize

openstack/nova · GHSA-m4f3-qp2w-gwh6

critical2026-02-18

CVE-2025-14009-NLTK has a Zip Slip Vulnerability

nltk/nltk · GHSA-7p94-766c-hgjp

high2026-02-18

CVE-2026-53875-Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER

mmaitre314/picklescan · GHSA-97f8-7cmv-76j2

high2026-02-18

CVE-2026-28468-OpenClaw has an authentication bypass in sandbox browser bridge server

openclaw/openclaw · GHSA-h9g4-589h-68xv

high2026-02-18

CVE-2026-28451-OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension

openclaw/openclaw · GHSA-x22m-j5qq-j49m

high2026-02-18

CVE-2026-29611-OpenClaw has a LFI in BlueBubbles media path handling

openclaw/openclaw · GHSA-rwj8-p9vq-25gv

medium2026-02-18

CVE-2026-27486-OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup

openclaw/openclaw · GHSA-jfv4-h8mc-jcp8

medium2026-02-18

CVE-2026-28477-OpenClaw Chutes manual OAuth state validation bypass can cause credential substitution

openclaw/openclaw · GHSA-7rcp-mxpq-72pj

high2026-02-18

CVE-2026-27487-OpenClaw: Prevent shell injection in macOS keychain credential write

openclaw/openclaw · GHSA-4564-pvr2-qq4h

high2026-02-18

CVE-2026-28462-OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes

openclaw/openclaw · GHSA-gq9c-wg68-gwj2

medium2026-02-18

CVE-2026-26972-OpenClaw has a Path Traversal in Browser Download Functionality

openclaw/openclaw · GHSA-xwjm-j929-xq7c

medium2026-02-18

CVE-2026-27100-Jenkins has a build information disclosure vulnerability through Run Parameter

jenkinsci/jenkins · GHSA-wfhp-qgm8-5p5c

high2026-02-18

CVE-2026-27099-Jenkins has a stored XSS vulnerability in node offline cause description

jenkinsci/jenkins · GHSA-85h6-5m3v-gx37

low2026-02-18

CVE-2026-2654-Hugging Face Smolagents has a Server-Side Request Forgery issue

huggingface/smolagents · GHSA-jxgv-6j54-wwc7