Security advisories

critical2026-02-02

CVE-2026-22778-vLLM has RCE In Video Processing

vllm-project/vllm · GHSA-4r2x-xpjr-7cvv

medium2026-02-02

CVE-2025-69207-Khoj has an IDOR in Notion OAuth Flow that Enables Index Poisoning

khoj-ai/khoj · GHSA-6whj-7qmg-86qj

low2026-02-02

CVE-2026-1703-pip Path Traversal vulnerability

pypa/pip · GHSA-6vgw-5pg2-w6jp

medium2026-02-02

CVE-2026-25152-@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

backstage/backstage · GHSA-w669-jj7h-88m9

critical2026-02-02

CVE-2024-5986-H2O has an External Control of File Name or Path vulnerability

h2oai/h2o-3 · GHSA-wj3h-wx8g-x699

high2026-02-02

CVE-2026-0599-Hugging Face Text Generation Inference vulnerable to Uncontrolled Resource Consumption

huggingface/text-generation-inference · GHSA-j7x9-7j54-2v3h

high2026-02-02

CVE-2026-1117-Lollms has an Improper Access Control vulnerability

parisneo/lollms · GHSA-82fw-ch24-j34w

high2026-02-02

CVE-2025-10279-mlflow Creates of Temporary File in Directory with Insecure Permissions

mlflow/mlflow · GHSA-4x5p-f36r-mxxr

medium2026-02-02

CVE-2025-6208-llama-index-core vulnerable to Uncontrolled Resource Consumption

run-llama/llama_index · GHSA-488g-hw5f-x29p

low2026-02-02

CVE-2026-1518-Keycloak Server-Side Request Forgery (SSRF) vulnerability

keycloak/keycloak · GHSA-fwhw-chw4-gh37

high2026-02-02

CVE-2026-1530-fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation

fog/fog-kubevirt · GHSA-m3hq-3qj8-c5fm

low2026-02-02

CVE-2025-13881-Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes

keycloak/keycloak · GHSA-g78x-7vwx-9f58

high2026-02-02

CVE-2026-1531-foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set

theforeman/foreman_kubevirt · GHSA-2qxw-7fmx-gqfm

high2026-02-02

CVE-2026-24788-RaspAP raspap-webgui contains an OS Command Injection vulnerability

raspap/raspap-webgui · GHSA-4wwf-f7w3-94f5

high2026-02-01

CVE-2025-67601-Rancher CLI skips TLS verification on Rancher CLI login command

rancher/rancher · GHSA-mc24-7m59-4q5p

medium2026-02-01

CVE-2026-23835-LobeHub Vulnerable to Improper Authorization in Presigned Upload

lobehub/lobehub · GHSA-wrrr-8jcv-wjf5

high2026-01-30

CVE-2025-62349-Salt Authentication Protocol Version Downgrade Allows Minion Impersonation

saltstack/salt · GHSA-vcf3-26xf-fw4m

high2026-01-30

CVE-2025-62348-Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload

saltstack/salt · GHSA-77w2-v593-vxvv

high2026-01-30

CVE-2025-69662-geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure

geopandas/geopandas · GHSA-6497-prx7-gpmq

medium2026-01-30

CVE-2026-25129-PsySH has Local Privilege Escalation via CWD .psysh.php auto-load

bobthecow/psysh · GHSA-4486-gxhx-5mg7