Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 397 total.
Privilege escalation in IBM WebSphere Application Server administrative console (CVE-2026-14446)
IBM WebSphere Application Server contains a broken access control vulnerability (CWE-306: Missing Authentication for Critical Function) in its administrative console. An unauthenticated remote attacker could exploit t...
Fixed in 9.0.5.29; 8.5.5.31
Path traversal in IBM Aspera Desktop App (CVE-2026-14973)
IBM Aspera Desktop App contains a path traversal vulnerability that allows files to be written outside of the user's selected download destination. This flaw, classified as CWE-22 (Improper Limitation of a Pathname to...
Fixed in 1.1.0
Cross-tenant credential reuse in HashiCorp Terraform MCP Server (CVE-2026-16498)
The terraform-mcp-server before version 1.1.0 contains a cross-tenant credential reuse vulnerability in stateless streamable-HTTP transport mode. Because the server's per-session Terraform client cache relies on sessi...
Fixed in 1.1.0
Arbitrary SQL execution as superuser via pglogical queue (CVE-2026-50736)
The pglogical queue mechanism executes message payloads on subscriber nodes at superuser privilege level. A party controlling a publisher endpoint can send crafted queue messages to cause arbitrary SQL execution on th...
Fixed in 2.4.8
Privilege escalation via default expression evaluation in pglogical (CVE-2026-50737)
When pglogical applies replicated changes for a row missing one or more columns, it evaluates the affected table's default expressions on the subscriber under the apply worker's privilege level, which is equivalent to...
Fixed in 2.4.8
Server-Side Request Forgery in Plack::App::Prerender for Perl (CVE-2026-17552)
Plack::App::Prerender before version 0.3.0 can proxy requests to an arbitrary host due to unvalidated REQUEST_URI concatenation in the call method. When the rewrite base is a plain string, an attacker can submit a req...
Fixed in 0.3.0
JWT signature verification bypass in Apache Airflow FAB provider (CVE-2026-59243)
The FAB auth manager's Azure AD OAuth login path defaulted `verify_signature=False` when decoding the ID token, allowing an attacker to present a forged or unsigned (`alg:none`) ID token to the OAuth callback and auth...
Fixed in apache-airflow-providers-fab 3.7.3
SQL injection in Weidmueller PROCON-WEB SCADA (CVE-2026-16462)
The `GetGridData` endpoint in PROCON-WEB SCADA does not properly sanitize user input, allowing a remote unauthenticated attacker to execute arbitrary SQL commands. Successful exploitation may result in unauthorized re...
Fixed in 6.11.3
Authentication bypass via session flag in SMS Alert WordPress plugin (CVE-2026-15014)
The SMS Alert plugin for WordPress contains an authentication bypass vulnerability in the `processRegistration()` function. The function uses a session-level boolean flag (`$_SESSION['sa_mobile_verified']`) as the sol...
Fixed in 3.9.8
Unsafe deserialization in Apache Axis2/Java Tribes clustering component (CVE-2026-66713)
A deserialization of untrusted data vulnerability (CWE-502) exists in the Tribes-based clustering component of Apache Axis2/Java when deployed on Apache Tomcat with Tribes clustering enabled. An unauthenticated remote...
Fixed in 2.0.1
Expression sandbox escape leading to RCE in n8n (CVE-2026-27577)
An expression sandbox escape vulnerability in n8n's workflow automation platform allows an authenticated user with workflow creation or modification permissions to abuse crafted expressions in workflow parameters, tri...
Fixed in 1.123.22; 2.9.3; 2.10.1
Uncontrolled recursion in TOML::XS for Perl via bundled tomlc99 (CVE-2026-16634)
TOML::XS versions before 0.06 bundle an unmaintained version of the tomlc99 library that contains an uncontrolled recursion vulnerability. Parsing untrusted TOML input via `from_toml` can trigger a stack overflow thro...
Fixed in 0.06
Arbitrary PHP file write via configuration API in phpMyFAQ (CVE-2026-66398)
phpMyFAQ's configuration API allows authenticated administrators holding CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to manipulate the upgrade.lastDownloadedPackage setting to point to an attacker-controlled ZIP ...
Fixed in v4.1.6
Stored XSS to OS RCE via unescaped style attribute in SiYuan (CVE-2026-66396)
SiYuan fails to escape the `title-img` Individual Attribute List value before interpolating it into the `style` attribute of cover images rendered in the Attribute-View Gallery and Kanban features. An attacker with ed...
Fixed in v3.7.2
Reflected XSS to OS RCE in SiYuan desktop via siyuan:// deep link (CVE-2026-66395)
The SiYuan desktop app registers `siyuan://` as an OS-level protocol handler and reflects an attacker-controlled path segment from `siyuan://bazaar/plugins/<payload>/readme` URLs verbatim into a `showMessage` call tha...
Fixed in v3.7.2
Stored and reflected XSS in SiYuan via SVG sanitizer bypass (CVE-2026-66394)
SiYuan's SVG sanitizer parses attacker-supplied SVG input using an HTML parser while the browser receives the output as image/svg+xml (XML). Because HTML and XML parsers treat elements such as desc, style, and noscrip...
Fixed in v3.7.3
Shell command injection in Catalyst::View::Wkhtmltopdf (CVE-2026-16766)
Catalyst::View::Wkhtmltopdf's render() method builds a shell command via plain string interpolation and executes it through backticks with no quoting or escaping. Seven per-request render options read from the request...
Fixed in 0.6.1
PHP eval injection in vBulletin template runtime runMaths() (CVE-2026-61511)
vBulletin contains an eval injection vulnerability in the `vB5_Template_Runtime::runMaths()` method within `/includes/vb5/template/runtime.php`, where user-supplied input is insufficiently sanitized before being passe...
Fixed in 6.2.2
Unauthenticated file upload DoS and information leak in Langflow (CVE-2026-55450)
The deprecated `POST /api/v1/upload/{flow_id}` endpoint in Langflow requires no authentication and imposes no file size or rate limits, allowing any network-accessible party to exhaust server disk space and cause deni...
Fixed in >= 1.9.1
NoSQL operator injection in Budibase published-app query templates (CVE-2026-54350)
The `enrichContext` function in `@budibase/server` substitutes user-supplied parameter values directly into raw JSON query bodies without escaping JSON metacharacters, allowing an attacker to inject NoSQL operators in...
Fixed in 3.39.12