Security advisories

medium2026-01-23

CVE-2026-24128-XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

xwiki/xwiki-platform · GHSA-wvqx-m5px-6cmp

high2026-01-23

CVE-2026-0994-protobuf affected by a JSON recursion depth bypass

protocolbuffers/protobuf · GHSA-7gcm-g887-7qv7

high2026-01-23

CVE-2026-0603-Hibernate vulnerable to SQL Injection

hibernate/hibernate-orm · GHSA-2p5w-cvg5-gc5c

high2026-01-23

CVE-2025-67847-Moodle affected by a code injection vulnerability

moodle/moodle · GHSA-xvmh-25jw-gmmm

high2026-01-23

CVE-2026-0770-Langflow affected by Remote Code Execution via validate_code() exec()

langflow-ai/langflow · GHSA-g22f-v6f7-2hrh

medium2026-01-23

CVE-2026-20904-Gitea does not properly validate ownership when toggling OpenID URI visibility

go-gitea/gitea · GHSA-qqgv-v353-cv8p

medium2026-01-23

CVE-2026-20912-Gitea does not properly validate repository ownership when linking attachments to releases

go-gitea/gitea · GHSA-4xx9-vc8v-87hv

medium2026-01-23

CVE-2026-20750-Gitea does not properly validate project ownership in organization project operations

go-gitea/gitea · GHSA-rw22-5hhq-pfpf

low2026-01-23

CVE-2026-20736-Gitea has improper access control for uploaded attachments

go-gitea/gitea · GHSA-hgr3-x44x-33hx

medium2026-01-23

CVE-2026-20888-Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface

go-gitea/gitea · GHSA-9cgq-wp42-4rpq

low2026-01-23

CVE-2026-0798-Gitea may send release notification emails for private repositories to users whose access has been revoked

go-gitea/gitea · GHSA-8fwc-qjw5-rvgp

medium2026-01-23

CVE-2026-20897-Gitea does not properly validate repository ownership when deleting Git LFS locks

go-gitea/gitea · GHSA-393c-qgvj-3xph

low2026-01-23

CVE-2026-20800-Gitea improperly exposes issue and pull request titles

go-gitea/gitea · GHSA-2vgv-hgv4-22mh

low2026-01-22

CVE-2026-20613-Container and Containerization archive extraction does not guard against escapes from extraction base directory.

apple/containerization · GHSA-cq3j-qj2h-6rv3

low2026-01-22

CVE-2026-26188-Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue

solspace/craft-freeform · GHSA-jp3q-wwp3-pwv9

medium2026-01-22

CVE-2025-22234-Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide

spring-projects/spring-security · GHSA-vqxh-445g-37fc

medium2026-01-22

CVE-2026-24137-sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal

sigstore/sigstore · GHSA-fcv2-xgw5-pqxf

high2026-01-22

CVE-2026-23954-Incus container image templating arbitrary host file read and write

lxc/incus · GHSA-7f67-crqm-jgh7

high2026-01-22

CVE-2026-23953-Incus container environment configuration newline injection

lxc/incus · GHSA-x6jc-phwx-hp32

medium2026-01-22

CVE-2026-24117-Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL

sigstore/rekor · GHSA-4c4x-jm2x-pf9j