Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Unauthenticated SQL injection in Metacat REST API endpoints (CVE-2026-48528)
Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints. The `nodeId` parameter is appended to backend SQL queries with...
Fixed in >= 3.4.1
OIDC userinfo scope bypass in Gitea (CVE-2026-55982)
The OIDC userinfo endpoint (`GET /login/oauth/userinfo`) in Gitea accepts personal access tokens as bearer credentials without enforcing their assigned scopes. A token scoped only to `read:misc` - which is denied acce...
Fixed in 1.27.0
Publish-boundary bypass via WebSocket broadcast in SiYuan (CVE-2026-72810)
SiYuan's kernel registers WebSocket sessions established through the publish surface into the same broadcast session pool as authenticated sessions, with no role or publish-access filtering applied to outgoing content...
Fixed in v3.7.4
SQL injection in SiYuan backlink/mention search query (CVE-2026-72811)
The backlink/mention search query in SiYuan (kernel/model/backlink.go) concatenates stored block metadata and client-supplied keywords into a SQL MATCH statement, escaping only double quotes and leaving single quotes ...
Fixed in v3.7.4
Missing scope enforcement on disable2fa endpoint in getgrav/grav-plugin-api (CVE-2026-72822)
The grav-plugin-api Composer package fails to invoke requirePermission() on the admin (non-self) path of the disable2fa endpoint, meaning the api_key_scopes cap is never applied. A holder of a narrow-scope API key on ...
Fixed in 1.0.13
API key scope-cap bypass enabling SSTI in Grav API plugin (CVE-2026-72824)
The Grav API plugin's `PagesController::guardTwigContent()` enforces the Twig-toggle check with a bare `isSuperAdmin()` gate that never consults `api_key_scopes`. A least-privilege API key scoped only to `api.pages.wr...
Fixed in 1.0.13
API key scope escalation in Grav CMS plugin API (CVE-2026-72826)
The getgrav/grav-plugin-api plugin does not validate that scopes assigned to a newly created API key are a subset of the requesting caller's own scopes. An attacker with a minimal api.access-scoped key on a super acco...
Fixed in 1.0.13
API-key scope cap bypass in Grav API plugin UsersController (CVE-2026-72829)
The Grav API plugin's UsersController create() and update() methods enforce the scope cap only for api.users.write but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly wi...
Fixed in 1.0.13
API-key scope cap bypass in Grav API plugin enabling RCE (CVE-2026-72830)
The Grav API plugin's `ConfigController` enforces the API-key scope cap in only one location (`AbstractApiController::requirePermission()`), which is bypassed by super-scope gates that rely on a bare `isSuperAdmin()` ...
Fixed in 1.0.13
Home directory collision via case-folded usernames in FileBrowser (CVE-2026-72836)
FileBrowser's self-registration handler compares stored directory scopes with a case-sensitive exact string match, while Windows/NTFS resolves paths case-insensitively. When Signup and CreateUserDir are both enabled a...
Fixed in 2.63.19
Unauthenticated account takeover in Wishlist Member plugin for WordPress (CVE-2026-12949)
The Wishlist Member plugin for WordPress contains an insufficient verification of data authenticity flaw in the wpm_register() function. The function validates the registration cookie only against the GET reg paramete...
Fixed in 3.34.2
Unauthenticated remote code execution in FreePBX UCP Node server (CVE-2026-73665)
FreePBX versions prior to 17.0.9 contain an authentication bypass in the UCP Node server caused by Socket.IO v4 applying middleware only to the default namespace, leaving custom namespaces unauthenticated. An unauthen...
Fixed in 17.0.9
Unicode homoglyph email bypass in NextAuth.js magic-link flow (CVE-2026-73420)
The default email normalizer in NextAuth.js validates an address before applying Unicode normalization, allowing an address containing a homoglyph at-sign character (e.g., U+FF20 FULLWIDTH COMMERCIAL AT) to pass the s...
Fixed in @auth/core 0.41.3
Arbitrary file write via S3 key path traversal in Budibase (CVE-2026-72850)
Budibase's `sanitizeKey` helper preserves `..` segments in S3 object keys because the underlying `sanitize-s3-objectkey@0.0.1` library does not strip them. An authenticated user with builder or admin permissions can u...
Fixed in 3.40.0
Unauthenticated SQL injection in Budibase webhook automations (CVE-2026-72851)
Budibase automation webhook endpoints are unauthenticated by design, allowing any attacker who knows a webhook's (instance, id) pair to POST attacker-controlled JSON that is spliced into EXECUTE_QUERY step bindings an...
Fixed in 3.40.0
SQL injection in FreePBX missedcall module via inbound Caller ID name (CVE-2026-73663)
The FreePBX missedcall module inserts the inbound caller's name directly into a SQL INSERT statement in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated remote attacker can craft a...
Fixed in 16.0.11 (FreePBX 16); 17.0.6 (FreePBX 17)
External file path control enabling remote code execution in IBM Documentation Offline (CVE-2026-17482)
IBM Documentation Offline contains a vulnerability in its embedded Node.js server's template engine whereby external control of a file path (CWE-73) allows a remote, unauthenticated attacker to execute arbitrary code ...
Fixed in 1.5.1
Brute force authentication bypass in IBM Langflow OSS (CVE-2026-19297)
IBM Langflow OSS contains a rate-limiting control on the login endpoint that can be explicitly disabled by an administrator or left unvalidated post-deployment. When disabled, a remote unauthenticated attacker can sub...
Fixed in 1.10.0
Arbitrary file read via AppRole secretIDPath in Vault Secrets Operator (CVE-2026-8715)
Vault Secrets Operator 1.3.0 through 1.4.1 contains a flaw in the AppRole authentication configuration where the `spec.appRole.secretIDPath` field on VaultAuth and VaultAuthGlobal custom resources lacks sufficient pat...
Fixed in Vault Secrets Operator 1.5.0
Cross-project deployment worker registration bypass in Trigger.dev (CVE-2026-73656)
The deployment background-worker registration endpoint in Trigger.dev authenticates requests but looks up the target deployment by friendly ID only, without scoping the lookup to the authenticated environment or proje...
Fixed in >= v4.5.0-rc.3