Security advisories

medium2026-09-03

CVE-2026-56743-Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

View chart →

cilium/cilium · GHSA-fm8w-2m5w-9j7r

critical2026-09-03

CVE-2026-71428-unstructured: Server-Side Request Forgery in the URL-based partitioning

View chart →

unstructured-io/unstructured · GHSA-4mvj-m6j5-pmf7

medium2026-09-03

SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)

View chart →

siyuan-note/siyuan · GHSA-gw25-m53r-qh88

high2026-09-03

SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass

View chart →

siyuan-note/siyuan · GHSA-99rq-75j6-5j9f

medium2026-09-03

CVE-2026-73846-CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

View chart →

ondata/ckan-mcp-server · GHSA-78x9-fhhx-v2g6

low2026-09-03

CVE-2026-73844-CKAN MCP Server: Information disclosure via verbose error reflection

View chart →

ondata/ckan-mcp-server · GHSA-6f9w-9hf2-5rg3

high2026-09-02

CVE-2026-73667-OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

View chart →

openchoreo/openchoreo · GHSA-2mw5-23gm-pccq

medium2026-09-02

CVE-2026-73840-OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

View chart →

openchoreo/openchoreo · GHSA-c5f6-2rm9-2w8g

high2026-09-02

CVE-2026-73841-OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

View chart →

openchoreo/openchoreo · GHSA-52gf-6rpq-fgmx

critical2026-09-02

CVE-2026-73843-OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

View chart →

openchoreo/openchoreo · GHSA-qh9r-j7rp-4x2m

high2026-09-02

CVE-2026-67445-Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

View chart →

axllent/mailpit · GHSA-w878-pj84-3j5v

high2026-09-02

CVE-2026-72921-SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

View chart →

seaweedfs/seaweedfs · GHSA-gv5w-hfx8-8cwq

critical2026-09-02

CVE-2026-71485-Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

View chart →

centrifugal/centrifugo · GHSA-9468-v6mj-fppw

high2026-09-02

CVE-2026-67446-Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

View chart →

axllent/mailpit · GHSA-75mr-qw9x-3r39

high2026-09-02

CVE-2026-84366-Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

View chart →

scrapy/scrapy · GHSA-76g3-c3x4-crvx

medium2026-09-02

CVE-2026-68921-DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

View chart →

dicebear/dicebear · GHSA-gcr2-9v8m-gq45

high2026-09-02

CVE-2026-62676-Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

View chart →

omnigent-ai/omnigent · GHSA-7mqg-cx4g-x2rf

high2026-09-02

CVE-2026-65842-Plate: SSRF with response disclosure in DOCX image embedding

View chart →

udecode/plate · GHSA-4q39-2jhr-7qx8

high2026-09-02

CVE-2026-63490-Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

View chart →

jknack/handlebars.java · GHSA-g29j-rwfv-h99w

medium2026-09-02

CVE-2026-63481-Hurl: Cookies in Cookies section leak when redirecting to a different host

View chart →

orange-opensource/hurl · GHSA-7w2g-9mf9-324m