Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 397 total.
Missing authentication on traffic-influence API in free5GC NEF (CVE-2026-44326)
The Network Exposure Function (NEF) in free5GC mounts the `3gpp-traffic-influence` API without inbound OAuth2/bearer-token authorization, allowing any network-reachable party to create, read, patch, and delete traffic...
Fixed in v4.2.2
Missing authentication on NEF OAM route group in free5GC (CVE-2026-44327)
free5GC's Network Exposure Function (NEF) mounts the `nnef-oam` route group without inbound OAuth2/bearer-token authorization middleware, despite advertising OAuth2 enforcement. Any network-reachable party can send un...
Fixed in v4.2.2
Missing authentication middleware on UPI route group in free5GC SMF (CVE-2026-44329)
The SMF component of free5GC mounts its UPI management route group without OAuth2/bearer-token authorization middleware, allowing any network attacker with access to the SMF Service-Based Interface to invoke UPI endpo...
Fixed in v4.2.2
Missing inbound authentication on nnef-pfdmanagement API in free5GC NEF (CVE-2026-44330)
free5GC's NEF mounts the `nnef-pfdmanagement` route group without any inbound OAuth2/bearer-token authorization middleware, despite advertising `OAuth2 setting receive from NRF: true`. Any network attacker able to rea...
Fixed in v4.2.2
Sandbox escape via Function.caller leakage in SandboxJS (CVE-2026-43898)
Sandbox-defined functions in SandboxJS expose `Function.caller`, enabling sandboxed code to recover the internal `LispType.Call` runtime callback. An attacker can invoke this callback with attacker-controlled `context...
Fixed in 0.9.6
Stored/Reflected XSS via HTML entity bypass in DeepChat SVG rendering (CVE-2026-43900)
DeepChat's SVGSanitizer uses plain-text regular expressions to strip `javascript:` protocols from SVG artifacts, but does not decode HTML entities before applying these checks. A malicious SVG containing obfuscated en...
Fixed in v1.0.4-beta.1
Remote code execution bypass via Markdown links in DeepChat (CVE-2026-43899)
An incomplete fix for CVE-2025-55733 leaves DeepChat's Electron-based AI platform vulnerable to arbitrary protocol execution leading to remote code execution. While the prior patch restricted `api.openExternal()` in t...
Fixed in v1.0.4-beta.1
Insufficient authorization in WHMCS Client Area addon handling (CVE-2026-29204)
An authenticated WHMCS Client Area user can submit requests referencing another user's addon ID without any ownership validation in `clientarea.php`. This allows an attacker with a valid session to perform actions in ...
Fixed in WHMCS 9.0.4; WHMCS 8.13.3
Authentication bypass in fast-jwt via empty async HMAC secret (CVE-2026-44351)
A critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When an async key resolver returns an em...
Fixed in 6.2.4
SNS webhook signature bypass in Plunk email platform (CVE-2026-42193)
The `/webhooks/sns` endpoint in Plunk accepts Amazon SNS notification payloads without verifying the SNS signature, certificate, or topic ARN, allowing any unauthenticated remote attacker to forge webhook requests. A ...
Fixed in 0.9.0
Unauthenticated Remote Code Execution in FastGPT agent-sandbox (CVE-2026-42302)
The agent-sandbox component of FastGPT initializes code-server with authentication disabled (--auth none) and binds to all network interfaces (0.0.0.0:8080), allowing any network-accessible user to gain unauthenticate...
Fixed in 4.14.13
Improper input validation of HTTP/2 request headers in Apache Tomcat (CVE-2026-41293)
Apache Tomcat failed to validate HTTP/2 request headers, potentially exposing header values through the Servlet API that were not compliant with the HTTP specification. This could trigger unexpected application behavi...
Fixed in Apache Tomcat 11.0.22; Apache Tomcat 10.1.55; Apache Tomcat 9.0.118
Authentication bypass in Apache Tomcat digest authenticator (CVE-2026-43512)
When DIGEST authentication is configured in Apache Tomcat, any user not known to the configured Realm is authenticated if they present the password "null". This allows unauthorized users to bypass authentication contr...
Fixed in 11.0.22; 10.1.55; 9.0.118
Improper authorization in Apache Tomcat security constraints (CVE-2026-43515)
When multiple security constraints define an HTTP method constraint for the same extension pattern, only the first method constraint is applied. This incorrect application of security constraints constitutes an improp...
Fixed in 11.0.22; 10.1.55; 9.0.118
Buffer overflow in Intel Data Center Graphics Driver for VMware ESXi (CVE-2026-20794)
A buffer overflow vulnerability exists in the Intel Data Center Graphics Driver for VMware ESXi within Ring 1: Device Drivers. A local privileged attacker can exploit this vulnerability with low complexity and no user...
Fixed in 2.0.2
Unauthenticated file system access in WGDashboard (CVE-2026-44343)
WGDashboard contains critical vulnerabilities that allow unauthorized parties to access the host file system without authentication. Exploitation is most likely against instances exposed on publicly accessible networks.
Fixed in 4.3.2
Remote code execution in 9router via MCP plugin argument injection (CVE-2026-63732)
9router v0.4.59 contains a chain of three vulnerabilities that together allow a remote, unauthenticated attacker to achieve arbitrary code execution on the host operating system with no operator interaction required. ...
Fixed in 0.4.60
Unauthenticated remote code execution in Cal.com (cal.diy) via Next.js RSC (CVE-2025-71389)
Cal.com (cal.diy) bundles a vulnerable version of Next.js whose React Server Components request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to trigger arbitrary co...
Fixed in >= 5.9.9
Authentication bypass in SAML Single Sign On plugin for WordPress (CVE-2026-15981)
The SAML Single Sign On - SSO Login plugin for WordPress contains an authentication bypass vulnerability caused by the mo_saml_validate_signature() function performing a loose boolean check on the tri-state integer re...
Fixed in 5.4.5
Authentication bypass via X-Forwarded-For spoofing in Cleanuparr (CVE-2026-44183)
TrustedNetworkAuthenticationHandler.ResolveClientIp trusts the leftmost entry of the X-Forwarded-For header as the client IP, but that value is attacker-controlled since X-Forwarded-For is append-only. An unauthentica...
Fixed in 2.9.10