# Vulnerabilities published in 2026 - [GHSA-h9mw-h4qc-f5jf](https://insights.sbomify.com/GHSA-h9mw-h4qc-f5jf/): **CVSS 6.5 Medium** — The GraphQL API served by kubernetes-graphql-gateway is vulnerable to Denial-of-Service (DoS) attacks due to a complet (not scored) - [GHSA-h97f-6pqj-q452](https://insights.sbomify.com/GHSA-h97f-6pqj-q452/): OpenClaw has a IPv6 multicast SSRF classifier bypass (not scored) - [GHSA-h8w2-rv57-vc6f](https://insights.sbomify.com/GHSA-h8w2-rv57-vc6f/): splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution (not scored) - [GHSA-h8cj-hpmg-636v](https://insights.sbomify.com/GHSA-h8cj-hpmg-636v/): appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution (not scored) - [GHSA-h829-5cg7-6hff](https://insights.sbomify.com/GHSA-h829-5cg7-6hff/): gitverify has improper tag signature verification (not scored) - [GHSA-h72h-ppcx-998p](https://insights.sbomify.com/GHSA-h72h-ppcx-998p/): Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length (not scored) - [GHSA-h656-5vcf-cm23](https://insights.sbomify.com/GHSA-h656-5vcf-cm23/): OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check (not scored) - [GHSA-h5x4-m2qf-r4f2](https://insights.sbomify.com/GHSA-h5x4-m2qf-r4f2/): Possible UTF-8 corruption in Diesels SQLite backend (not scored) - [GHSA-h5rg-8p7f-47g2](https://insights.sbomify.com/GHSA-h5rg-8p7f-47g2/): SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch (not scored) - [GHSA-h5jc-78hr-3pc9](https://insights.sbomify.com/GHSA-h5jc-78hr-3pc9/): Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe (not scored) - [GHSA-h5fq-653g-gxrm](https://insights.sbomify.com/GHSA-h5fq-653g-gxrm/): ots has a negative expire override that can bypass its secret retention policy (not scored) - [GHSA-h4hf-v6w5-897x](https://insights.sbomify.com/GHSA-h4hf-v6w5-897x/): Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account (not scored) - [GHSA-h4h3-3rfj-x6fq](https://insights.sbomify.com/GHSA-h4h3-3rfj-x6fq/): SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field (not scored) - [GHSA-h4g2-xfmw-q2c9](https://insights.sbomify.com/GHSA-h4g2-xfmw-q2c9/): Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset (not scored) - [GHSA-h4fw-6r7f-w494](https://insights.sbomify.com/GHSA-h4fw-6r7f-w494/): Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy (not scored) - [GHSA-h4fr-cmh5-qr62](https://insights.sbomify.com/GHSA-h4fr-cmh5-qr62/): Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root (not scored) - [GHSA-h3hw-29fv-2x75](https://insights.sbomify.com/GHSA-h3hw-29fv-2x75/): @envelop/graphql-modules has a Race Condition vulnerability (not scored) - [GHSA-h39g-6x3c-7fq9](https://insights.sbomify.com/GHSA-h39g-6x3c-7fq9/): Zio has SubFileSystem Path Confinement Bypass via Unresolved `..` Segment (not scored) - [GHSA-h37v-hp6w-2pp8](https://insights.sbomify.com/GHSA-h37v-hp6w-2pp8/): ml-dsa's UseHint function has off by two error when r0 equals zero (not scored) - [GHSA-h2v8-394m-p7vv](https://insights.sbomify.com/GHSA-h2v8-394m-p7vv/): The built-in (but disabled by default) Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. (not scored) - [GHSA-h29g-c9cx-c73q](https://insights.sbomify.com/GHSA-h29g-c9cx-c73q/): torrentpier has PHP Serialize Injections (not scored) - [GHSA-h25m-26qc-wcjf](https://insights.sbomify.com/GHSA-h25m-26qc-wcjf/): Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components (not scored) - [GHSA-gxxh-8vcj-w2mh](https://insights.sbomify.com/GHSA-gxxh-8vcj-w2mh/): livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler (not scored) - [GHSA-gxhx-2686-5h9g](https://insights.sbomify.com/GHSA-gxhx-2686-5h9g/): slack-go `SecretsVerifier` accepts empty signing secret without precondition (not scored) - [GHSA-gx7w-56w6-g48x](https://insights.sbomify.com/GHSA-gx7w-56w6-g48x/): Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching (not scored) - [GHSA-gw32-9rmw-qwww](https://insights.sbomify.com/GHSA-gw32-9rmw-qwww/): svelte is vulnerable to XSS with textarea bind:value (not scored) - [GHSA-gv8r-9rw9-9697](https://insights.sbomify.com/GHSA-gv8r-9rw9-9697/): Traefik affected by TLS ClientAuth Bypass on HTTP/3 (not scored) - [GHSA-grh9-37g7-53mj](https://insights.sbomify.com/GHSA-grh9-37g7-53mj/): WireGuard Portal v2 has Open Redirect Vulnerability in OAuth Authentication Flow (not scored) - [GHSA-gr3r-crp5-qrrm](https://insights.sbomify.com/GHSA-gr3r-crp5-qrrm/): Compromised tag of intercom-php published via GitHub (not scored) - [GHSA-gqvg-gmmx-x4hm](https://insights.sbomify.com/GHSA-gqvg-gmmx-x4hm/): MLflow introduced `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` as a security control to prevent unsafe `pickle.load` execution during mo (not scored) - [GHSA-gqqj-85qm-8qhf](https://insights.sbomify.com/GHSA-gqqj-85qm-8qhf/): Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email (not scored) - [GHSA-gq4g-fpc9-vjfq](https://insights.sbomify.com/GHSA-gq4g-fpc9-vjfq/): Impact `Webauthn\SimpleFakeCredentialGenerator` is the library-provided default implementation of the `FakeCredentialGenerator` interface. (not scored) - [GHSA-gpxg-fx2g-qxj2](https://insights.sbomify.com/GHSA-gpxg-fx2g-qxj2/): The kanidmd web UI renders the WebAuthn passkey-registration challenge as raw JSON inside an inline `