Verified Advisories

Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 263 total.

Severity: All Critical High

Library: grav 12 SurrealDB 10 openclaw 10 Java 9 mongodb_server 7 avi_load_balancer 6 code.gitea.io/gitea 6 langflow_oss 6 Grav 5 datacycle_core 5 nextcrm_app 4 telerik_ui_for_asp_net_ajax 4 unbound 4 fogproject 3 freescout 3 surrealdb 3 apache_mina_sshd 3 mpp 3 Wazuh 3 getkirby/cms 3

CVE-2026-45576 HIGH CVSS 8.3 Verified Advisory Jul 16, 2026

Path traversal in zrok's `copy` command (CVE-2026-45576)

CVE-2026-45576 is a path traversal vulnerability in zrok's `copy` command. When copying from a WebDAV or zrok drive source, a malicious share operator can return a crafted DAV `href` (e.g., `/../outside.txt`) that cau...

Fixed in 2.0.3

Path Traversal Suse

CVE-2026-49987 HIGH CVSS 7.5 Verified Advisory Jul 15, 2026

Argument injection in repomix npm package (CVE-2026-49987)

CVE-2026-49987 is an argument injection vulnerability (CWE-88) in the `repomix` npm package, affecting the `--remote-branch` CLI option. User-supplied input is passed unsanitized to `git fetch` and `git checkout` subp...

Fixed in 1.14.1

RCE

CVE-2026-53518 HIGH CVSS 7.6 Verified Advisory Jul 15, 2026

Race condition in the `@better-auth/oauth-provider` package (CVE-2026-53518)

CVE-2026-53518 is a race condition vulnerability in the `@better-auth/oauth-provider` package and related `better-auth` plugin paths whereby two concurrent POST requests to the OAuth authorization code token endpoint ...

Fixed in @better-auth/oauth-provider 1.6.11; better-auth 1.6.11

Authentication Bypass Microsoft Nginx Redis

Prev Page 14 of 14