Security advisories

high2026-02-02

CVE-2026-1777-SageMaker Python SDK has Exposed HMAC

aws/sagemaker-python-sdk · GHSA-rjrp-m2jw-pv9c

high2026-02-02

CVE-2026-1778-SageMaker Python SDK has Insecure TLS Configuration

aws/sagemaker-python-sdk · GHSA-62rc-f4v9-h543

medium2026-02-02

CVE-2026-25523-Magento's X-Original-Url header can expose admin url

openmage/magento-lts · GHSA-jg68-vhv3-9r8f

medium2026-02-02

CVE-2026-25522-Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation

craftcms/commerce · GHSA-h9r9-2pxg-cx9m

medium2026-02-02

CVE-2026-25490- Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation

craftcms/commerce · GHSA-wq2m-r96q-crrf

medium2026-02-02

CVE-2026-25489-Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation

craftcms/commerce · GHSA-v585-mf6r-rqrc

medium2026-02-02

CVE-2026-25488-Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation

craftcms/commerce · GHSA-p6w8-q63m-72c8

medium2026-02-02

CVE-2026-25487-Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation

craftcms/commerce · GHSA-wqc5-485v-3hqh

medium2026-02-02

CVE-2026-25486-Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation

craftcms/commerce · GHSA-g92v-wpv7-6w22

medium2026-02-02

CVE-2026-25485-Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation

craftcms/commerce · GHSA-w8gw-qm8p-j9j3

medium2026-02-02

CVE-2026-25484-Craft Commerce has Stored XSS in Product Type Name

craftcms/commerce · GHSA-2h2m-v2mg-656c

medium2026-02-02

CVE-2026-25483-Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration

craftcms/commerce · GHSA-8478-rmjg-mjj5

medium2026-02-02

CVE-2026-25482-Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

craftcms/commerce · GHSA-frj9-9rwc-pw9j

medium2026-02-02

CVE-2026-25228-SignalK Server has Path Traversal leading to information disclosure

signalk/signalk-server · GHSA-vrhw-v2hw-jffx

low2026-02-02

CVE-2026-25224-Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

fastify/fastify · GHSA-mrq3-vjjr-p77c

high2026-02-02

CVE-2026-25223-Fastify's Content-Type header tab character allows body validation bypass

fastify/fastify · GHSA-jx2c-rxcm-jvmq

critical2026-02-02

CVE-2026-25521-locutus is vulnerable to Prototype Pollution

locutusjs/locutus · GHSA-rxrv-835q-v5mh

medium2026-02-02

CVE-2026-25518-cert-manager-controller DoS via Specially Crafted DNS Response

cert-manager/cert-manager · GHSA-gx3x-vq4p-mhhv

critical2026-02-02

CVE-2026-25510-CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor

ci4-cms-erp/ci4ms · GHSA-gp56-f67f-m4px

medium2026-02-02

CVE-2026-25509-CI4MS Vulnerable to User Email Enumeration via Password Reset Flow

ci4-cms-erp/ci4ms · GHSA-654x-9q7r-g966