Security advisories

low2026-01-26

CVE-2026-1190-Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods

keycloak/keycloak · GHSA-63v5-26vq-m4vm

medium2026-01-26

CVE-2025-14525-KubeVirt Guest Agent DoS via Excessive Network Interface Reports

kubevirt/kubevirt · GHSA-25mh-hp8x-cgrv

medium2026-01-26

CVE-2026-24131-pnpm has Path Traversal via arbitrary file permission modification

pnpm/pnpm · GHSA-v253-rj99-jwpq

high2026-01-26

CVE-2026-24123-BentoML has a Path Traversal via Bentofile Configuration

bentoml/bentoml · GHSA-6r62-w2q3-48hf

medium2026-01-26

CVE-2026-23888-pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

pnpm/pnpm · GHSA-6pfh-p556-v868

medium2026-01-26

CVE-2026-23889-pnpm has Windows-specific tarball Path Traversal

pnpm/pnpm · GHSA-6x96-7vc8-cm3p

medium2026-01-26

CVE-2026-23890-pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin

pnpm/pnpm · GHSA-xpqm-wm3m-f34h

medium2026-01-26

CVE-2026-24056-pnpm has symlink traversal in file:/git dependencies

pnpm/pnpm · GHSA-m733-5w8f-5ggw

critical2026-01-26

CVE-2026-22709-vm2 has a Sandbox Escape

patriksimek/vm2 · GHSA-99p7-6v5w-7xg8

critical2026-01-26

CVE-2026-22696-dcap-qvl has Missing Verification for QE Identity

phala-network/dcap-qvl · GHSA-796p-j2gh-9m2q

low2026-01-26

CVE-2026-24656-Apache Karaf Decanter has Deserialization of Untrusted Data in its Log Socket Collector

apache/karaf-decanter · GHSA-jmw5-58c7-587h

critical2026-01-26

CVE-2016-15057-Apache Continuum vulnerable to Command Injection through Installations REST API

apache/continuum · GHSA-77p9-w6pj-rmvg

high2026-01-26

CVE-2025-27821-Apache Hadoop HDFS Native Client has Out-of-bounds Write Vulnerability

apache/hadoop · GHSA-92cc-952p-v8rh

medium2026-01-23

CVE-2026-24422-phpMyFAQ: Public API endpoints expose emails and invisible questions

thorsten/phpmyfaq · GHSA-j4rc-96xj-gvqc

medium2026-01-23

CVE-2026-24421-phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)

thorsten/phpmyfaq · GHSA-wm8h-26fv-mg7g

medium2026-01-23

CVE-2026-24420-phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

thorsten/phpmyfaq · GHSA-7p9h-m7m8-vhhv

medium2026-01-23

CVE-2025-71177-LavaLite CMS affected by a stored cross-site scripting vulnerability

lavalite/cms · GHSA-w7rq-fgx4-4xcm

critical2026-01-23

CVE-2025-66719-Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value

free5gc/nrf · GHSA-q7c8-gfjh-8v4p

medium2026-01-23

CVE-2025-67124-miniserve affected by a TOCTOU and symlink race vulnerability

svenstaro/miniserve · GHSA-mxc8-4jqf-368q

high2026-01-23

CometBFT has inconsistencies between how commit signatures are verified and how block time is derived

cometbft/cometbft · GHSA-c32p-wcqj-j677