Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 397 total.
Path traversal in Apache Kyuubi REST batch multipart upload (CVE-2026-52680)
Apache Kyuubi's REST batch multipart upload handler uses the client-supplied filename without sanitization when creating temporary resources. A remote attacker with access to the REST batch upload endpoint can supply ...
Fixed in 1.12.0
Weak password recovery mechanism in osTicket by Enhancesoft LLC (CVE-2026-18363)
A logic vulnerability in osTicket's password reset token validation routine allows tokens with an existing timestamp to bypass expiry validation, as the expiry check is only performed when the timestamp lookup fails. ...
Fixed in v1.17.8; v1.18.4
Missing authentication for MQTT broker in Phoenix Contact CHARX SEC-3xxx (CVE-2026-44090)
The MQTT broker on Phoenix Contact CHARX SEC-3xxx EV charging controllers lacks authentication, allowing an unauthenticated remote attacker to access it directly. The broker is only protected from external access by a...
Fixed in FW 1.9.1
Missing authentication in Phoenix Contact CHARX SEC-3xxx OCPP Agent service (CVE-2026-44101)
The CHARX OCPP Agent service in Phoenix Contact CHARX SEC-3xxx EV charging controllers lacks authentication, allowing an unauthenticated remote attacker to reconfigure the backend connection. This can result in Denial...
Fixed in FW 1.9.1
Unsigned firmware update in Phoenix Contact CHARX SEC-3xxx charging controllers (CVE-2026-44104)
The firmware update process for the basemodule of the CHARX SEC-3xxx charging controllers validates only a CRC32 checksum and performs no cryptographic signature verification. An unauthenticated remote attacker can ex...
Fixed in FW 1.9.1
Firewall shutdown race condition in Phoenix Contact CHARX SEC-3xxx charging controllers (CVE-2026-44108)
A flaw in the execution order of scripts during system shutdown causes the firewall to terminate prematurely, creating a temporary window in which internal services become externally accessible. An unauthenticated rem...
Fixed in FW 1.9.1
Command injection in Phoenix Contact CHARX SEC-3xxx charging controllers (CVE-2026-7849)
An improper neutralization of special elements in the firmware of Phoenix Contact CHARX SEC-3xxx EV charging controllers allows an unauthenticated remote attacker to inject a command into the system configuration. The...
Fixed in FW 1.9.1
Blind SQL injection in Plesk XML-RPC API (CVE-2026-58046)
A blind SQL injection vulnerability exists in Plesk's XML-RPC API due to improper input neutralization. A remote authenticated user with customer or reseller privileges can execute arbitrary SQL queries against the Pl...
Fixed in 18.0.79.4
Unauthenticated remote code execution in Admin and Site Enhancements (ASE) Pro for WordPress (CVE-2026-16610)
The Admin and Site Enhancements (ASE) Pro plugin for WordPress contains a PHP code injection vulnerability in the recursive_html function. The frontend save handler lacks authentication checks, CAPTCHA validation can ...
Fixed in 8.9.1
Arbitrary file read and RCE in Rails Active Storage variant processing (CVE-2026-66066)
Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation during variant processing. An unauthenticated attacker can exploit this to ...
Fixed in 7.2.3.2; 8.0.5.1; 8.1.3.1
Cross-tenant credential reuse in HashiCorp Consul MCP Server (CVE-2026-16326)
consul-mcp-server versions 0.1.0 through 0.1.3 did not correctly isolate per-client session state when operating in stateless mode. This flaw may allow an authenticated Consul client belonging to one session to be reu...
Fixed in 0.1.4
Unauthenticated SSRF and secret exfiltration in Flyto2 Core verification service (CVE-2026-67426)
The standalone flyto-verification service in Flyto2 Core exposes an unauthenticated POST /run endpoint bound to all interfaces on port 8344. An attacker-supplied callback_url is used verbatim for an outbound POST that...
Fixed in 2.26.7
Arbitrary file write in Flyto2 Core file-writing modules (CVE-2026-67429)
Flyto2 Core's `image.download` and related file-writing modules accept a caller-controlled `output_dir` parameter as the base path for path confinement checks instead of using the central `validate_path_with_env_confi...
Fixed in 2.26.6
Remote code execution in AWS Amplify Studio codegen-ui via unsafe expression evaluation (CVE-2025-4318)
The @aws-amplify/codegen-ui package evaluates UI component property expressions (such as placeholder, label, and value fields) using unsafe dynamic execution functions-eval(), new Function(), and vm.runInNewContext()-...
Fixed in 2.20.3
Missing authentication and IPv6 wildcard UDP bind in NASA AMMOS AIT-DSN (CVE-2026-60113)
The CLTU UDP listener in AIT-DSN's Space Link Extension (SLE) interface manager binds to the IPv6 wildcard address `::` instead of the operator-configured host, accepting traffic from any network interface on dual-sta...
Fixed in 2.2.2
Server-side request forgery in Prebid Server bidder adapters (CVE-2026-54735)
Certain bidder adapters in Prebid Server accept user-supplied parameters that are interpolated into outbound request URLs without proper input validation. A malicious actor can craft bid request parameters to cause th...
Fixed in 4.4.0
Missing authorization to unauthenticated arbitrary post deletion in Meta Box AIO (CVE-2026-14488)
The Meta Box AIO plugin for WordPress contains a missing authorization vulnerability in the MB Frontend Submission extension. The `handle_request()` function routes the `mbfs_delete` action without any capability or o...
Fixed in 3.9.0
Unauthenticated remote code execution in Cost Calculator Builder PRO (CVE-2026-14900)
The Cost Calculator Builder PRO plugin for WordPress contains insufficient sanitization of the `orderDetails[*].originalValue` field, which is injected verbatim into a calculator formula string passed to PHP `eval()` ...
Fixed in 4.0.4
--no-delete bypass via WebDAV MOVE in goshs (CVE-2026-64863)
The WebDAV mode-flag guard in goshs classifies MOVE as a write-only verb and checks it only against the read-only flag, never against the no-delete flag. As a result, a WebDAV client can delete the source file via MOV...
Fixed in v2.1.4
SFTP authentication bypass via empty password in goshs (CVE-2026-62325)
goshs contains a logic error in its SFTP password handler setup where a boolean `&&` operator causes the `PasswordHandler` to remain unset when either the username or password field is empty. When started with `-b 'us...
Fixed in v2.1.4