Security advisories

medium2026-02-10

CVE-2026-25878-FroshAdminer Adminer UI is accessible without admin session

friendsofshopware/froshplatformadminer · GHSA-f339-246p-wwjp

low2026-02-10

Bitcoinrb Vulnerable to Command injection via RPC

chaintope/bitcoinrb · GHSA-q66h-m87m-j2q6

high2026-02-09

CVE-2026-1529-Keycloak affected by improper invitation token validation

keycloak/keycloak · GHSA-hcvw-475w-8g7p

medium2026-02-09

CVE-2025-14778-Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService

keycloak/keycloak · GHSA-fm6w-rrp3-2x4w

high2026-02-09

CVE-2026-1486-Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

keycloak/keycloak · GHSA-37gf-gmxv-74wv

medium2026-02-09

CVE-2026-25765-Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url

lostisland/faraday · GHSA-33mh-2634-fwr2

medium2026-02-09

CVE-2026-25528-LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

langchain-ai/langsmith-sdk · GHSA-v34v-rq6j-cj6p

high2026-02-09

CVE-2026-25498-Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

craftcms/cms · GHSA-7jx7-3846-m7w7

high2026-02-09

CVE-2026-25497-Craft CMS: GraphQL Asset Mutation Privilege Escalation

craftcms/cms · GHSA-fxp3-g6gw-4r4v

medium2026-02-09

CVE-2026-25496-Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields

craftcms/cms · GHSA-9f5h-mmq6-2x78

high2026-02-09

CVE-2026-25495-Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`

craftcms/cms · GHSA-2453-mppf-46cj

medium2026-02-09

CVE-2026-25494-Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation

craftcms/cms · GHSA-m5r2-8p9x-hp5m

medium2026-02-09

CVE-2026-25493-Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect

craftcms/cms · GHSA-8jr8-7hr4-vhfx

medium2026-02-09

CVE-2026-25492-Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

craftcms/cms · GHSA-96pq-hxpw-rgh8

low2026-02-09

CVE-2026-25491-Craft CMS Vulnerable to Stored XSS in Entry Types Name

craftcms/cms · GHSA-7pr4-wx9w-mqwr

high2026-02-09

CVE-2026-25761-Super-linter is vulnerable to command injection via crafted filenames in Super-linter Action

super-linter/super-linter · GHSA-r79c-pqj3-577x

high2026-02-09

CVE-2026-25639-Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

axios/axios · GHSA-43fc-jf86-j433

medium2026-02-09

CVE-2026-25598-Harden-Runner: Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)

step-security/harden-runner · GHSA-cpmj-h4f6-r6pq

medium2026-02-09

CVE-2026-25480-Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)

litestar-org/litestar · GHSA-vxqx-rh46-q2pg

medium2026-02-09

CVE-2026-25479-Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns

litestar-org/litestar · GHSA-93ph-p7v4-hwh4