Security advisories

high2026-02-10

CVE-2026-26007-cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

pyca/cryptography · GHSA-r6ph-v2qm-q3c2

critical2026-02-10

CVE-2026-21531-Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE

azure/azure-sdk-for-python · GHSA-436v-jg82-p533

critical2026-02-10

CVE-2026-1774-CASL Ability is Vulnerable to Prototype Pollution

stalniy/casl · GHSA-x9vf-53q3-cvx6

medium2026-02-10

cap-go/capacitor-native-biometric Authentication Bypass

cap-go/capgo · GHSA-vx5f-vmr6-32wf

high2026-02-10

CVE-2026-25577-Emmett-Core: Unhandled CookieError Exception Causing Denial of Service

emmett-framework/core · GHSA-x6cr-mq53-cc76

critical2026-02-10

CVE-2026-23906-Apache Druid Vulnerable to Authentication Bypass

apache/druid · GHSA-q672-hfc7-g833

medium2026-02-10

CVE-2025-11537-Keycloak logs sensitive headers

keycloak/keycloak · GHSA-gv3v-2cpp-3pmq

low2026-02-10

CVE-2026-23901-Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability

apache/shiro · GHSA-c4qc-4q9p-m9q9

medium2026-02-10

CVE-2026-25957-Cube Core is vulnerable to Denial of Service (DoS) via crafted request

cube-js/cube · GHSA-9vph-2hvm-x66g

high2026-02-10

CVE-2026-25958-Cube Core is vulnerable to privilege escalation via a specially crafted request

cube-js/cube · GHSA-v226-32c7-x2v7

high2026-02-10

CVE-2026-25951-FUXA Affected by a Path Traversal Sanitization Bypass

frangoteam/fuxa · GHSA-68m5-5w2h-h837

medium2026-02-10

CVE-2026-25934-go-git improperly verifies data integrity values for .idx and .pack files

go-git/go-git · GHSA-37cx-329c-33x3

critical2026-02-10

CVE-2026-25939-FUXA Unauthenticated Remote Arbitrary Scheduler Write

frangoteam/fuxa · GHSA-c869-jx4c-q5fc

critical2026-02-10

CVE-2026-25938-FUXA Unauthenticated Remote Code Execution in Node-RED Integration

frangoteam/fuxa · GHSA-v4p5-w6r3-2x4f

medium2026-02-10

amphp/http-server affected by HTTP/2 DDoS vulnerability

amphp/http-server · GHSA-8grv-jq2g-cfhw

medium2026-02-10

CVE-2026-25918-unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)

rageagainstthepixel/unity-cli · GHSA-4255-c27h-62m5

high2026-02-10

CVE-2026-25892-Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint

vrana/adminer · GHSA-q4f2-39gr-45jh

high2026-02-10

CVE-2026-25890-File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL

filebrowser/filebrowser · GHSA-4mh3-h929-w968

critical2026-02-10

CVE-2026-25881-@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)

nyariv/sandboxjs · GHSA-ww7g-4gwx-m7wj

medium2026-02-10

CVE-2026-25889-File Browser has an Authentication Bypass in User Password Update

filebrowser/filebrowser · GHSA-hxw8-4h9j-hq2r