Security advisories

high2026-02-09

CVE-2026-25478-Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins

litestar-org/litestar · GHSA-2p2x-hpg8-cqp2

critical2026-02-09

CVE-2025-66630-Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure

gofiber/fiber · GHSA-68rr-p4fp-j59v

medium2026-02-09

CVE-2026-22922-Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access

apache/airflow · GHSA-pm44-x5x7-24c4

medium2026-02-09

CVE-2026-23903-Apache Shiro has an Authentication Bypass

apache/shiro · GHSA-c244-p6m5-vqj6

medium2026-02-09

CVE-2026-24098-Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users

apache/airflow · GHSA-5g2w-9f8g-g5q7

medium2026-02-09

CVE-2026-25905-MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability

pydantic/mcp-run-python · GHSA-pfv4-wmph-5gc6

medium2026-02-09

CVE-2026-25904-MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access

pydantic/mcp-run-python · GHSA-6fgp-m6q4-j3q5

high2026-02-09

CVE-2026-1615-jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions

dchester/jsonpath · GHSA-87r5-mp6g-5w5j

low2026-02-08

CVE-2026-2178-xcode-mcp-server vulnerable to Command Injection

r-huijts/xcode-mcp-server · GHSA-84fx-pwf3-7777

medium2026-02-08

CVE-2026-2130-mcp-maigret vulnerable to command injection

burtthecoder/mcp-maigret · GHSA-2g7v-hghf-grg4

high2026-02-06

CVE-2026-25791-Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service

bishopfox/sliver · GHSA-wxrw-gvg8-fqjp

high2026-02-06

CVE-2026-25804-Antrea has invalid enforcement order for network policy rules caused by integer overflow

antrea-io/antrea · GHSA-86x4-wp9f-wrr9

critical2026-02-06

CVE-2026-1709-Keylime Missing Authentication for Critical Function and Improper Authentication

keylime/keylime · GHSA-4jqp-9qjv-57m2

low2026-02-06

LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic

authzed/spicedb · GHSA-vhvq-fv9f-wh4q

critical2026-02-06

`polymarket-clients-sdk` was removed from crates.io for malicious code

polymarket/rs-clob-client · GHSA-382q-fpqh-29f7

high2026-02-06

CVE-2026-25793-Blocklist Bypass possible via ECDSA Signature Malleability

slackhq/nebula · GHSA-69x3-g4r3-p962

high2026-02-06

CVE-2026-25762-AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection

adonisjs/core · GHSA-xx9g-fh25-4q64

medium2026-02-06

CVE-2025-65852-Gogs has authorization bypass in repository deletion API

gogs/gogs · GHSA-rjv5-9px2-fqw6

high2026-02-06

Gogs vulnerable to Stored XSS via Mermaid diagrams

gogs/gogs · GHSA-26gq-grmh-6xm6

critical2026-02-06

A single post-release of dydx-v4-client contained obfuscated multi-stage loader

lenktn/lenktn-dydx-v4-python · GHSA-4f84-67cv-qrv3