Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 121 total.
Heap-based buffer overflow in Wazuh agent syscheck registry wildcard expansion (CVE-2026-40106)
A heap-based buffer overflow exists in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards, the agent allocates a fixed 256-byte heap buffer and performs unsafe st...
Fixed in >=4.14.5
Rate limit bypass via /events endpoint in Wazuh Manager (CVE-2026-33434)
A logic error in `CheckRateLimitsMiddleware.dispatch()` unconditionally overwrites the global rate limit check result with the /events endpoint-specific check result, discarding whether the global `max_request_per_min...
Fixed in >= 4.14.5
Stored XSS via link annotations in ArgoCD enabling privilege escalation (CVE-2026-45738)
A user with developer-role application write access can set `link.argocd.argoproj.io/*` annotations containing `javascript:` URIs using a pipe-separator trick, which are rendered as `<a href>` elements in the applicat...
Fixed in 3.2.12; 3.3.10; 3.4.2
Host confusion via backslash authority delimiter in fast-uri (CVE-2026-16221)
fast-uri versions from 2.3.1 through 4.1.0 do not treat a literal backslash character (U+005C) as an authority delimiter, while Node's native WHATWG URL parser normalizes backslashes to forward slashes for special sch...
Fixed in 2.4.3; 3.1.4; 4.1.1
Uncaught exception in SurrealDB's net module (CVE-2025-71391)
CVE-2025-71391 is an uncaught exception vulnerability in SurrealDB's net module, triggered when a crafted HTTP query containing a null byte is sent to the /sql endpoint, causing JSON conversion to fail with an unhandl...
Fixed in 2.2.2; 2.1.5; 2.0.5
SurrealQL injection in SurrealDB export command (CVE-2025-71392)
SurrealDB's command-line export command fails to properly escape table and field names, enabling SurrealQL injection in exported backup files. An authenticated System User with OWNER or EDITOR roles can craft maliciou...
Fixed in 2.0.5; 2.1.5; 2.2.2
Memory exhaustion in SurrealDB string::replace (CVE-2025-71395)
SurrealDB contains a memory exhaustion vulnerability in the string::replace function whereby the use of regex patterns imposes no restriction on the resulting string length. An authenticated attacker can exploit this ...
Fixed in 2.2.2; 2.1.5; 2.0.5
Denial of service via nested loop functions in SurrealDB (CVE-2025-71397)
SurrealDB contains a denial-of-service vulnerability in which authenticated users with OWNER or EDITOR permissions at the root, namespace, or database level can define custom database functions using nested FOR loops ...
Fixed in 2.0.5; 2.1.5; 2.2.2
Path restriction bypass in @fastify/http-proxy (CVE-2026-16117)
@fastify/http-proxy fails to rewrite the request prefix when percent-encoded characters are used in the prefix portion of the URL. Because Fastify's router URL-decodes paths for route matching while request.url retain...
Fixed in 11.6.0
Path traversal in @fastify/http-proxy WebSocket upstream routing (CVE-2026-15631)
@fastify/http-proxy fails to validate the resolved WebSocket destination path against the configured rewrite prefix, because the WebSocket upstream target is built with the WHATWG URL constructor, which performs RFC-3...
Fixed in >= 11.6.0
URL cache key collision in @fastify/reply-from (CVE-2026-16158)
CVE-2026-16158 is a URL cache key collision vulnerability in @fastify/reply-from. The plugin constructs internal cache keys by concatenating the destination and source path without a delimiter, allowing different (des...
Fixed in 12.6.4
Directory traversal in VMware Avi Load Balancer (CVE-2026-47871)
CVE-2026-47871 is a directory traversal vulnerability in VMware Avi Load Balancer caused by flaws in file path validation. Malicious authenticated network users can exploit this vulnerability to perform directory trav...
Fixed in 32.1.2; 31.2.2-2p3; 30.2.7
Remote code execution in VMware Avi Load Balancer (CVE-2026-47869)
CVE-2026-47869 is a remote code execution vulnerability in VMware Avi Load Balancer. A malicious authenticated user with network access may be able to inject and execute code. Broadcom has rated this vulnerability in ...
Fixed in 32.1.2; 31.2.2-2p3; 30.2.7
Privilege escalation in VMware Avi Load Balancer (CVE-2026-47870)
CVE-2026-47870 is a privilege escalation vulnerability in VMware Avi Load Balancer. A malicious authenticated user with network access may be able to execute remote code. Broadcom has evaluated the severity as Importa...
Fixed in 32.1.2; 31.2.2-2p3; 30.2.7
Local privilege escalation in VMware Avi Load Balancer (CVE-2026-47868)
CVE-2026-47868 is a local privilege escalation vulnerability in VMware Avi Load Balancer. A malicious user with local access may be able to escalate their privileges to run code as root. Broadcom has evaluated the sev...
Fixed in 32.1.2; 31.2.2-2p3; 30.2.7
Remote code execution in VMware Avi Load Balancer (CVE-2026-47867)
CVE-2026-47867 is a remote code execution vulnerability in VMware Avi Load Balancer affecting the Avi Control plane. A malicious user with network access may be able to access the Avi Control plane and execute code re...
Fixed in 32.1.2; 31.2.2-2p3; 30.2.7
Authorization bypass in VMware Avi Load Balancer (CVE-2026-47866)
CVE-2026-47866 is an authorization bypass vulnerability in VMware Avi Load Balancer. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization. Broadcom has eva...
Fixed in 32.1.2; 31.2.2-2p3; 30.2.7
Heap buffer overflow in Linux kernel IPv6 UDP stack (CVE-2026-53362)
CVE-2026-53362 is a Linux kernel heap buffer overflow in `__ip6_append_data()` caused by incorrect accounting of `fraggap` bytes on the paged allocation path, resulting in writes past `skb->end` into the trailing `skb...
Fixed in 6.12.95
Server-Side Request Forgery in CloudTAK (CVE-2026-55177)
CVE-2026-55177 is an authenticated full-read Server-Side Request Forgery (CWE-918) in CloudTAK's `/api/esri*` route family, where user-controlled URLs supplied via request body or query parameters are fetched by the s...
Fixed in >= v13.10.0
Unauthenticated denial of service in JLine3 remote-telnet module (CVE-2026-56740)
CVE-2026-56740 is an unauthenticated remote denial-of-service vulnerability in the JLine3 remote-telnet module (org.jline:jline-remote-telnet). The function TelnetIO.readNEVariables() (TelnetIO.java:1127-1180) stores ...
Fixed in 3.30.14; 4.2.1