Security advisories

medium2026-01-13

CVE-2026-22703-Cosign verification accepts any valid Rekor entry under certain conditions

sigstore/cosign · GHSA-whqx-f9j3-ch6m

medium2026-01-13

CVE-2025-68949-n8n: Webhook Node IP Whitelist Bypass via Partial String Matching

n8n-io/n8n · GHSA-w96v-gf22-crwp

high2026-01-13

CVE-2025-68931-Jervis's AES CBC Mode is Without Authentication

samrocketman/jervis · GHSA-gxp5-mv27-vjcj

medium2026-01-13

CVE-2025-68925-Jervis Has a JWT Algorithm Confusion Vulnerability

samrocketman/jervis · GHSA-5pq9-5mpr-jj85

high2026-01-13

CVE-2025-68704-Jervis Has Weak Random for Timing Attack Mitigation

samrocketman/jervis · GHSA-c9q6-g3hr-8gww

high2026-01-13

CVE-2025-68703-Jervis's Salt for PBKDF2 derived from password

samrocketman/jervis · GHSA-36h5-vrq6-pp34

high2026-01-13

CVE-2025-68702-Jervis Has a SHA-256 Hex String Padding Bug

samrocketman/jervis · GHSA-67rj-pjg6-pq59

high2026-01-13

CVE-2025-68701-Jervis has Deterministic AES IV Derivation from Passphrase

samrocketman/jervis · GHSA-crxp-chh4-9ghp

high2026-01-13

CVE-2025-68698-Jervis Has a RSA PKCS#1 Padding Vulnerability

samrocketman/jervis · GHSA-mqw7-c5gg-xq97

medium2026-01-12

CVE-2026-22251-Weblate wlc has insecure API key configuration

weblateorg/wlc · GHSA-9rp8-h4g8-8766

low2026-01-12

CVE-2026-22250-Weblate command-line client susceptible to SSL verification skip

weblateorg/wlc · GHSA-2mmv-7rrp-g8xh

high2026-01-12

CVE-2026-22033-Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field

humansignal/label-studio · GHSA-2mq9-hm29-8qch

high2026-01-12

CVE-2025-68472-MindsDB has improper sanitation of filepath that leads to information disclosure and DOS

mindsdb/mindsdb · GHSA-qqhf-pm3j-96g7

high2026-01-12

CVE-2025-14279-MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation

mlflow/mlflow · GHSA-pgqp-8h46-6x4j

high2026-01-11

CVE-2025-68493-Apache Struts 2 is Missing XML Validation

apache/struts · GHSA-qcfc-hmrc-59x7

low2026-01-11

CVE-2025-15506-AcademySoftwareFoundation OpenColorIO has an out-of-bounds vulnerability

academysoftwarefoundation/opencolorio · GHSA-m86r-wr74-693h

low2026-01-10

CVE-2026-0824-QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting

questdb/ui · GHSA-xf94-h87h-g9wr

low2026-01-10

CVE-2025-15504-LIEF is vulnerable to segmentation fault

lief-project/lief · GHSA-mjjp-xjfg-97wg

critical2026-01-10

CVE-2026-22584-Salesforce Uni2TS has a Code Injection vulnerability

salesforceairesearch/uni2ts · GHSA-7x99-8x99-xc54

high2026-01-09

CVE-2026-22699-SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()

rustcrypto/elliptic-curves · GHSA-78p6-6878-8mj6