Security advisories

medium2026-02-04

CVE-2023-43636-EVE Doesn't Protect Rootfs

lf-edge/eve · GHSA-5h7v-g49c-h887

medium2026-02-04

CVE-2023-43635-EVE Seals Vault Key With SHA1 PCRs

lf-edge/eve · GHSA-4jvr-vj2c-8q37

medium2026-02-04

CVE-2023-43634-EVE Doesn't Protect Config Partition with Measured Boot

lf-edge/eve · GHSA-wc42-fcjp-v8vq

medium2026-02-04

CVE-2023-43633-EVE's Debug Functions Unlockable Without Triggering Measured Boot

lf-edge/eve · GHSA-4c4v-42hc-72p6

low2026-02-04

CVE-2026-22254-Winter CMS has Stored Cross-site Scripting (XSS) in Asset Manager

wintercms/winter · GHSA-m7gw-rffq-rxjm

medium2026-02-04

CVE-2023-43632-EVE Freely Allocates Buffer on The Stack With Data From Socket

lf-edge/eve · GHSA-6jp5-grgh-jw42

medium2026-02-04

CVE-2023-43631-EVE: SSH as Root Unlockable Without Triggering Measured Boot

lf-edge/eve · GHSA-3mq9-xhgq-r7gj

medium2026-02-04

CVE-2023-43630-EVE Doesn't Measure Config Partition From 2 Fronts

lf-edge/eve · GHSA-phcg-h58r-gmcq

low2026-02-04

git2 has potential undefined behavior when dereferencing Buf struct

rust-lang/git2-rs · GHSA-j39j-6gw9-jw6h

critical2026-02-04

CVE-2026-25632-EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)

waterfutures/epyt-flow · GHSA-74vm-8frp-7w68

medium2026-02-04

CVE-2026-25631-n8n's domain allowlist bypass enables credential exfiltration

n8n-io/n8n · GHSA-2xcx-75h9-vr9h

high2026-02-04

openmls has improper tag validation

openmls/openmls · GHSA-8x3w-qj7j-gqhf

critical2026-02-04

CVE-2025-62878-Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

rancher/local-path-provisioner · GHSA-jr3w-9vfr-c746

critical2026-02-04

CVE-2026-25630-survey-pdf Upgraded jsPDF Version Due to Security Vulnerability

surveyjs/survey-pdf · GHSA-h3q6-jfrg-3x6q

high2026-02-04

CVE-2026-25593-OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply

openclaw/openclaw · GHSA-g55j-c2v4-pjcg

high2026-02-04

CVE-2026-25536-@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

modelcontextprotocol/typescript-sdk · GHSA-345p-7cg4-v4c7

high2026-02-04

CVE-2026-25546-godot-mcp has Command Injection via unsanitized projectPath

coding-solo/godot-mcp · GHSA-8jx2-rhfh-q928

high2026-02-04

CVE-2026-25538- Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage

devtron-labs/devtron · GHSA-8wpc-j9q9-j5m2

critical2026-02-04

CVE-2026-25115-n8n has a Python sandbox escape

n8n-io/n8n · GHSA-8398-gmmx-564h

critical2026-02-04

CVE-2026-25056-n8n Merge Node has Arbitrary File Write leading to RCE

n8n-io/n8n · GHSA-hv53-3329-vmrm