Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
SQL injection in SiYuan fullTextSearchAssetContent endpoint (CVE-2026-69083)
The `/api/search/fullTextSearchAssetContent` endpoint in SiYuan exposes two SQL injection flaws on the asset-content database. Method 2 passes a client-supplied SQL statement directly to a read-write database handle w...
Fixed in v3.7.3
SQL injection in SiYuan searchDocs endpoint via unescaped keyword (CVE-2026-69085)
The `/api/filetree/searchDocs` endpoint in SiYuan concatenates the caller-supplied `keyword` parameter directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish `RoleRe...
Fixed in v3.7.3
Authentication bypass in Check Point Security Management Server (CVE-2026-18574)
An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) allows an unauthenticated remote attacker with network access to Management services t...
Fixed in Jumbo Hotfix Accumulator for R82.10 Take 40; Jumbo Hotfix Accumulator for R82 Take 122; Jumbo Hotfix Accumulator for R81.20 Take 161
Authentication bypass in WAPT Enterprise Server (CVE-2026-33591)
A vulnerability in WAPT Server allows a remote unauthenticated attacker to bypass security restrictions using a specially crafted packet and retrieve a valid session token for the targeted account. This could allow an...
Fixed in 2.6.1.17813
Broken object level authorization in Vikunja task-collection endpoint (CVE-2026-68582)
The task-collection endpoint `GET /api/v1/projects/{project}/views/{view}/tasks` in Vikunja resolves the requested project view from the URL path without verifying the caller is authorized for it. A holder of any proj...
Fixed in 2.4.0
Base path poisoning denial of service in better-auth (npm) (CVE-2025-71401)
better-auth allows an external request to configure the server's baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup c...
Fixed in 1.4.2
GitHub Actions shell injection in Wazuh workflows via pull request (CVE-2026-67308)
Wazuh CI workflows trigger on pull requests from public forks and read VERSION.json from the attacker-controlled repository, writing its raw contents into environment variables that are directly interpolated into shel...
Fixed in 44bf114
Stack-based buffer overflow in libmodbus library (CVE-2024-10918)
A stack-based buffer overflow vulnerability exists in libmodbus v3.1.10. If the library attempts to reply to a Modbus request with an unexpected length, the buffer allocated for the Modbus response can be overflowed. ...
Fixed in v3.1.11
Authorization bypass in ArcadeDB HTTP endpoint handlers (CVE-2026-67342)
ArcadeDB contains an insecure direct object reference (IDOR) vulnerability in 14 HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. These handlers resolve the database path parameter and call get...
Fixed in 26.7.2
Scripting authorization bypass in ArcadeDB via SQL DEFINE FUNCTION (CVE-2026-67341)
ArcadeDB fails to enforce scripting authorization checks on the SQL `DEFINE FUNCTION ... LANGUAGE js` statement. Any user authorized for the database, including read-only roles, can submit this statement via the SQL r...
Fixed in 26.7.2
OS command execution via trigger scripts in ArcadeDB (CVE-2026-67340)
ArcadeDB's ScriptTriggerExecutor permits trigger scripts to access the java.lang.* package, enabling host-class lookups via Java.type(). An authenticated user holding UPDATE_SCHEMA permission can create a JavaScript t...
Fixed in 26.7.2
Authorization bypass in @better-auth/scim via provider-id collision (CVE-2026-67330)
The @better-auth/scim plugin used the same logical provider ID for SCIM provider configuration and account ownership, and SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, gener...
Fixed in 1.6.22; 1.7.0-rc.0
Insecure cryptographic defaults in better-auth oidcProvider and mcp plugins (CVE-2026-67336)
The legacy oidcProvider and mcp plugins in better-auth advertise the "none" algorithm in OIDC discovery metadata and accept PKCE plain method by default, contradicting RFC 9700 requirements. Relying parties performing...
Fixed in 1.6.11
Unsafe clone option gate bypass in GitPython via joined short options (CVE-2026-67324)
GitPython 3.1.50 fails to recognize joined short-option forms (e.g., `-u<value>`) when enforcing its unsafe-option gate during clone operations. An attacker who controls the `multi_options` argument passed to `Repo.cl...
Fixed in >= 3.1.51
Heap buffer overflow in FreeRDP Windows client clipboard virtual channel (CVE-2026-67305)
A heap buffer overflow exists in the FreeRDP Windows client (wfreerdp) when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs on the clipboard static virtual channel. A malicious RDP server can respond to a client file c...
Fixed in 3.29.0
Certificate purpose bypass in FreeRDP server TLS authentication (CVE-2026-67294)
FreeRDP's client-side TLS certificate verification improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during server authentication. In `x509_utils_verify()`, if server-purpose verificati...
Fixed in 3.29.0
Improper wildcard certificate hostname validation in FreeRDP (CVE-2026-67293)
FreeRDP's TLS hostname matcher incorrectly accepts wildcard certificates (e.g., *.example.com) for multi-label subdomains (e.g., a.b.example.com), which standard wildcard matching does not permit. This diverges from O...
Fixed in 3.29.0
Buffer over-disclosure and DoS via WebSocket Ping handling in FreeRDP (CVE-2026-67292)
FreeRDP's gateway WebSocket transport mishandles server-sent Ping control frames. A non-empty Ping causes the client to reply with an overlong Pong disclosing up to 1024 bytes of buffer contents beyond the received pa...
Fixed in 3.29.0
HTTP proxy CONNECT injection in FreeRDP via RDP redirection TargetNetAddress (CVE-2026-67289)
FreeRDP does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and written directly into the HTTP proxy CON...
Fixed in 3.29.0
TLS certificate identity validation bypass in FreeRDP (CVE-2026-66402)
FreeRDP performs custom Common Name and DNS SAN string matching instead of OpenSSL's length-aware identity validation APIs, introducing three distinct weaknesses in server identity verification: DNS SAN values are tru...
Fixed in 3.29.0