Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 397 total.
Authentication bypass via unverified SAML signature in Relyra (CVE-2026-49454)
Relyra versions 1.0.0 and 1.1.0 fail to cryptographically verify the SAML SignatureValue before returning a successful authentication result. The XMLDSig trust boundary is incomplete: no public-key verification is per...
Fixed in 1.2.0
Privilege escalation in PraisonAI praisonai-platform workspace member role endpoint (CVE-2026-47416)
The `PATCH /workspaces/{workspace_id}/members/{user_id}` endpoint in praisonai-platform performs no authorization check on the caller's role before updating a workspace member's role. Any workspace member, holding the...
Fixed in >= 0.1.4
Privilege escalation via missing role check in PraisonAI platform workspace member API (CVE-2026-47413)
The `POST /workspaces/{workspace_id}/members` endpoint in praisonai-platform only requires the caller to be a workspace member (minimum role) before accepting an arbitrary `user_id` and `role` from the request body. B...
Fixed in >= 0.1.4
NoSQL injection authentication bypass in Rocket.Chat CAS login handler (CVE-2026-45688)
Rocket.Chat's CAS login handler passes the client-supplied `credentialToken` value directly into a MongoDB `findOne` query without runtime type validation, allowing an unauthenticated attacker to substitute MongoDB qu...
Fixed in 8.5.0; 8.4.1; 8.3.3; 8.2.3; 8.1.4; 8.0.5; 7.13.7; 7.10.11
Command injection via unsanitized YAML parameter in Rancher Manager (CVE-2026-44939)
A command injection vulnerability in the Rancher Manager cluster import endpoint `/v3/import/{token}_{clusterId}.yaml` allows a remote attacker to inject arbitrary YAML keys into a generated Kubernetes manifest by inc...
Fixed in 2.14.2; 2.13.6; 2.12.10; 2.11.14; 2.10.12
Path traversal arbitrary file write in Fluentd `${tag}` placeholder (CVE-2026-44024)
Fluentd's validation of the `${tag}` placeholder used in file path construction is insufficient. When a Fluentd instance receives logs from untrusted sources and uses `${tag}` in output plugin path parameters such as ...
Fixed in 1.19.3
Remote code execution via unauthenticated file upload in Bludit CMS (CVE-2026-38329)
Bludit CMS before version 3.18.4 contains two flaws in the API plugin that together enable remote code execution. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php performs no authorization check and no ...
Fixed in 3.18.4
Code injection via unsanitized export names in happy-dom ECMAScriptModuleCompiler (CVE-2026-33943)
A code injection vulnerability in the `ECMAScriptModuleCompiler` component of happy-dom allows an attacker to inject arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts. The compiler...
Fixed in 20.8.8
Server secrets exfiltration via MCP server URL injection in LibreChat (CVE-2026-32625)
LibreChat's MCP server integration resolves `${VAR}` placeholders in user-supplied server URLs against the server's `process.env` during Zod schema validation. Any authenticated user can supply a malicious MCP server ...
Fixed in v0.8.4-rc1
Token scope bypass on archive download endpoint in Gitea (CVE-2026-20706)
The `/archive/*` web endpoint in Gitea does not enforce token scope checks, unlike the `/raw/*`, `/media/*`, and attachment endpoints fixed in PR #37698. A personal access token scoped to any non-repository category (...
Fixed in 1.26.2
SFTP authentication bypass in goshs via empty-username basic-auth (CVE-2026-40884)
goshs contains an authentication bypass in its SFTP service triggered when the server is started with the documented empty-username basic-auth syntax (`-b ':pass'`). Because the SFTP password handler is only installed...
Fixed in v2.0.0-beta.6
SQL injection in Vendure Shop API (@vendure/core) (CVE-2026-40887)
An unauthenticated SQL injection vulnerability exists in the Vendure Shop API where a user-controlled `languageCode` query string parameter is interpolated directly into a raw SQL expression without parameterization o...
Fixed in @vendure/core 2.3.4; @vendure/core 3.5.7; @vendure/core 3.6.2
Deserialization of untrusted data in OpenText RightFax .NET Remoting (CVE-2025-15610)
The .NET Remoting framework used by OpenText RightFax (Windows) contains a deserialization of untrusted data vulnerability enabling object injection. Unauthenticated remote attackers with access to the remoting ports ...
Fixed in Fax 21.2 Server; Fax 21.2 Client; Fax 22.2 Server; Fax 22.2 Client; Fax 23.4 Server; Fax 23.4 Client; Fax 24.4 Server; Fax 24.4 Client; Fax 25.4 Server; Fax 25.4 Client
Hard-coded credentials in Sonatype Nexus Repository Manager (CVE-2026-5189)
Sonatype Nexus Repository Manager 3.x contains a hard-coded credential in an internal database component that allows an unauthenticated attacker with network access to gain unauthorized read/write access to the intern...
Fixed in 3.71.0
Authentication bypass via X-Forwarded-Uri header spoofing in OAuth2 Proxy (CVE-2026-40575)
OAuth2 Proxy trusts a client-supplied X-Forwarded-Uri header when configured with --reverse-proxy and at least one --skip-auth-route or --skip-auth-regex rule. An attacker can spoof this header to cause OAuth2 Proxy t...
Fixed in > 7.15.1
Server-Side Template Injection bypass in Thymeleaf (CVE-2026-40477)
A security bypass vulnerability in Thymeleaf's expression execution mechanisms fails to properly restrict the scope of accessible objects within templates, allowing sensitive objects to be reached from template contex...
Fixed in 3.1.4.RELEASE
Server-Side Template Injection bypass in Thymeleaf (CVE-2026-40478)
A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. The library fails to properly neutralize specific syntax patterns, allowing bypass of its e...
Fixed in 3.1.4.RELEASE
Cross-namespace privilege escalation in ArgoCD Image Updater (CVE-2026-6388)
A flaw in ArgoCD Image Updater (a component of Red Hat OpenShift GitOps) allows an attacker with permissions to create or modify ImageUpdater resources to bypass namespace boundaries in multi-tenant environments. By e...
Fixed in v1.19.2
Heap-based buffer overflow in Apache Thrift C++ bindings (CVE-2026-55971)
A heap-based buffer overflow (write) vulnerability exists in the C++ bindings of Apache Thrift, specifically in THeaderTransport::untransform() during ZLIB decompression. This vulnerability could allow an attacker to ...
Fixed in 0.24.0
TLS hostname verification bypass in Apache Thrift c_glib bindings (CVE-2026-48144)
The c_glib TLS client bindings in Apache Thrift fail to properly validate that a server's certificate matches the expected hostname. This allows a network attacker to intercept TLS connections by presenting a certific...
Fixed in 0.24.0