Security advisories

medium2026-02-16

CVE-2025-14350-Mattermost fails to properly validate team membership when processing channel mentions

mattermost/mattermost · GHSA-57cc-2pf4-mhmx

high2026-02-16

CVE-2026-2415-pretix unsafely evaluates variables in emails

pretix/pretix · GHSA-r8p8-qw9w-j9qv

medium2026-02-16

CVE-2025-13821-Mattermost fails to sanitize sensitive data in WebSocket messages

mattermost/mattermost · GHSA-pp9j-pf5c-659x

medium2026-02-16

CVE-2026-0998-Mattermost Plugin Zoom fail to validate user identity and post ownership in the {{/api/v1/askPMI}} endpoint

mattermost/mattermost-plugin-zoom · GHSA-w65c-fvp5-fvc5

medium2026-02-16

CVE-2026-0999-Mattermost fails to properly validate login method restrictions

mattermost/mattermost · GHSA-3c9r-7f29-qp32

medium2026-02-16

CVE-2026-0997-Mattermost Plugin Zoom allows any logged-in user to change Zoom meeting restrictions for arbitrary channels

mattermost/mattermost-plugin-zoom · GHSA-2phx-frhf-xr55

low2026-02-16

CVE-2026-2531-MindsDB affected by a SSRF vulnerability

mindsdb/mindsdb · GHSA-6xw9-2p64-7622

medium2026-02-14

CVE-2026-2469-ImapEngine affected by command injection via the ID command parameters

directorytree/imapengine · GHSA-rfq9-4wcm-64gh

critical2026-02-13

CVE-2026-26273-Known affected by Account Takeover via Password Reset Token Leakage

idno/known · GHSA-78wq-6gcv-w28r

medium2026-02-13

Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site

cloudflare/agents · GHSA-w5cr-2qhr-jqc5

medium2026-02-13

rPGP's integrity protection of encrypted data was not always checked

rpgp/rpgp · GHSA-c7ph-f7jm-xv4w

high2026-02-13

rPGP affected by crash in message handling for deeply nested messages

rpgp/rpgp · GHSA-8h58-w33p-wq3g

high2026-02-13

rPGP vulnerable to parser crash on crafted RSA secret key packets through CVE-2026-21895

rpgp/rpgp · GHSA-7587-4wv6-m68m

medium2026-02-13

Child processes spawned by Renovate incorrectly have full access to environment variables

renovatebot/renovate · GHSA-8wc6-vgrq-x6cf

high2026-02-13

CVE-2025-23368-Wildfly Elytron integration susceptible to brute force attacks via CLI

wildfly/wildfly-core · GHSA-qhp6-6p8p-2rqh

high2026-02-13

Bug fixes in hpke-rs, hpke-rs-rust-crypto

cryspen/hpke-rs · GHSA-g433-pq76-6cmf

medium2026-02-13

CVE-2026-26226-beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS)

lukilabs/beautiful-mermaid · GHSA-cgmm-x5ww-q5cr

medium2026-02-13

sqlparse: formatting list of tuples leads to denial of service

andialbrecht/sqlparse · GHSA-27jp-wm6q-gp25

high2026-02-13

CVE-2026-26187-lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

treeverse/lakefs · GHSA-699m-4v95-rmpm

medium2026-02-13

CVE-2025-33042-Apache Avro Java SDK is Vulnerable to Code Injection

apache/avro · GHSA-rp46-r563-jrc7