GHSA-2CXR-HF6J-P3MC vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-azure...

3am-cli (0.1.0), 3am-diagnosis (0.1.0) +1456 more potentially affected by CVE-2026-41686 via @anthropic-ai/sdk (>=0.79.0, <=0.91.0)

@anthropic-ai/sdk NPM version =0.79.0, =0.5.0, =0.1.0, =1.0.0-alpha, =0.8.4, =0.1.8, =5.0.0, =5.0.0, =0.1.0, =1.3.0-canary.26.1, =1.3.0-canary.26.1, =1.3.0-canary.26.1, =1.6.3 - @adaptic/backend-legacy 0.0.941 and more Source cves: CVE-2026-41686 Source advisory: OSV:GHSA-P7FG-763F-G4GF...

GHSA-7GW9-CF7V-778F vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-4RC3-7J7W-M548 vulnerabilities

Vulnerabilities for packages: kibana...

GHSA-Q6QG-6FMG-JJCV vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

GHSA-5WVF-8JJJ-7W99 vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

GHSA-35H9-JH69-PC24 vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

GHSA-R37M-3HW5-974W vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

GHSA-F6WW-3GGP-FR8H vulnerabilities

Vulnerabilities for packages: npm, saf, wazuh-dashboard-fips, librechat, gitlab-rails-ce-fips, sqlpad, arangodb, actions-runner, wazuh-dashboard, gitlab-rails-ce...

CLEANSTART-2026-KL42544 Security fixes for ghsa-72hv-8253-57qq, ghsa-qqpg-mvqg-649v applied in versions: 3.9.4-r0, 3.9.4-r6

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MS93111 Security fixes for ghsa-72hv-8253-57qq applied in versions: 3.8.6-r0

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

GHSA-C4QG-J8JG-42Q5

creationtimestamp| type| source ---|---|--- 2026-04-26 03:29:34+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mkemho5wntb2 2026-04-26 07:57:04+00:00| seen|...

GHSA-M9HQ-H476-H2G8 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope...

GHSA-5JV8-H7QH-RF5P vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines, argo-workflows, kubeflow-pipelines-fips, kubeflow-pipelines-driver-fips...

CLEANSTART-2026-QM52705 Security fixes for ghsa-72hv-8253-57qq, ghsa-qqpg-mvqg-649v applied in versions: 3.9.4-r0, 3.9.4-r6

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-PQF5-4PQQ-29F5

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:03+00:00| published-proof-of-concept| Telegram/KzwiN8QhKmj3TuqYtGeX9siiyoqjfAY8f7zipbEz0Wiqhk...

GHSA-25QR-6MPR-F7QX

creationtimestamp| type| source ---|---|--- 2026-04-24 15:21:22+00:00| seen| Telegram/Y5QzcKDCmo7jQNGBLdJ87dzQSi2eRz7Wqhm7Qv2MeYFXM...

GHSA-JFWF-28XR-XW6Q

creationtimestamp| type| source ---|---|--- 2026-04-24 15:21:22+00:00| seen| Telegram/Y5QzcKDCmo7jQNGBLdJ87dzQSi2eRz7Wqhm7Qv2MeYFXM...

GHSA-V3QC-WRWX-J3PW

creationtimestamp| type| source ---|---|--- 2026-04-23 23:27:23+00:00| seen| Telegram/OgOvWOsYKDsUPw2Tk2S9qGbonIgzDZlRsoTRSBtlTZ01pNI...

Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)

Summary The fetch call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts line 28 uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing the isRemoteAllowed domain allowlist chec...