Security advisories

medium2026-02-12

CVE-2025-41117-Grafana has a Cross-site Scripting issue

grafana/grafana · GHSA-cqp7-wf4c-3xgc

medium2026-02-12

CVE-2026-2327-markdown-it is has a Regular Expression Denial of Service (ReDoS)

markdown-it/markdown-it · GHSA-38c4-r59v-3vqw

high2026-02-12

CVE-2026-0969-next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content

hashicorp/next-mdx-remote · GHSA-g4xw-jxrg-5f6m

medium2026-02-11

CVE-2025-69872-DiskCache has unsafe pickle deserialization

grantjenks/python-diskcache · GHSA-w8v5-vhqr-4h9v

medium2026-02-11

CVE-2025-69873-ajv has ReDoS when using `$data` option

ajv-validator/ajv · GHSA-2g4f-4pwh-qvx6

critical2026-02-11

CVE-2026-26190-Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

milvus-io/milvus · GHSA-7ppg-37fh-vcr6

high2026-02-11

CVE-2026-25935-Vikunja Vulnerable to XSS Via Task Preview

go-vikunja/vikunja · GHSA-m4g2-2q66-vc9v

medium2026-02-11

CVE-2025-69874-nanotar is vulnerable to path traversal in parseTar() and parseTarGzip()

unjs/nanotar · GHSA-92fh-27vv-894w

high2026-02-11

CVE-2026-25759-Statamic CMS vulnerable to privilege escalation via stored cross-site scripting

statamic/cms · GHSA-ff9r-ww9c-43x8

medium2026-02-11

CVE-2026-25633-Statamic CMS's missing authorization allows access to assets

statamic/cms · GHSA-gwmx-9gcj-332h

medium2026-02-11

CVE-2018-25157-Phraseanet vulnerable to stored cross-site scripting through crafted file names

alchemy-fr/phraseanet · GHSA-gcpq-mrgg-v5f3

medium2026-02-11

CVE-2019-25317-Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions

kimai/kimai · GHSA-9278-6hcj-2p4j

critical2026-02-11

CVE-2026-26021-set-in Affected by Prototype Pollution

ahdinosaur/set-in · GHSA-2c4m-g7rx-63q7

medium2026-02-11

CVE-2026-26019-@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation

langchain-ai/langchainjs · GHSA-gf3v-fwqg-4vh7

medium2026-02-11

CVE-2026-26014-Pion DTLS's usage of random nonce generation with AES GCM ciphers risks leaking the authentication key

pion/dtls · GHSA-9f3f-wv7r-qc8r

low2026-02-11

CVE-2026-26013-LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

langchain-ai/langchain · GHSA-2g6r-c272-w58r

high2026-02-11

CVE-2026-26010-Leaky JWTs in OpenMetadata exposing highly-privileged bot users

open-metadata/openmetadata · GHSA-pqqf-7hxm-rj5r

high2026-02-11

CVE-2026-25990-Pillow affected by out-of-bounds write when loading PSD images

python-pillow/pillow · GHSA-cfh3-3jmp-rvhc

high2026-02-10

CVE-2026-21218-Microsoft Security Advisory CVE-2026-21218 | .NET Security Feature Bypass Vulnerability

dotnet/runtime · GHSA-qvhc-9v3j-5rfw

medium2026-02-10

CVE-2026-2303-mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling

mongodb/mongo-go-driver · GHSA-cp6g-7hqx-qxhp