Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Stored XSS in hackage-server via unsanitized .cabal metadata (CVE-2026-40472)
User-controlled metadata from .cabal files is rendered into HTML href attributes without proper sanitization in hackage-server, enabling stored Cross-Site Scripting (XSS) attacks. The affected fields include homepage,...
Fixed in commit 2de3ae45082f8f3f29a41f6aff620d09d0e74058 or later
Use-after-free in Linux kernel TLS encryption error path (CVE-2026-31533)
A use-after-free vulnerability exists in the Linux kernel's TLS subsystem in the -EBUSY error path of tls_do_encryption(). When a crypto request is enqueued to the cryptd backlog and returns -EBUSY, both the async cal...
Fixed in linux-image-5.4.0-1077-xilinx-zynqmp 5.4.0-1077.81; linux-image-5.4.0-1105-ibm 5.4.0-1105.110; linux-image-5.4.0-1118-bluefield 5.4.0-1118.125; linux-image-5.4.0-1133-fips 5.4.0-1133.143; linux-image-5.4.0-1146-kvm 5.4.0-1146.155
Code injection in Flowise CSVAgent leads to remote code execution (CVE-2026-41137)
The CSVAgent component in Flowise accepts user-supplied custom Pandas CSV read code that is interpolated directly into an executable code string without sanitization and run via `pyodide.runPythonAsync`. An authentica...
Fixed in 3.1.0
Parameter override bypass remote command execution in Flowise (CVE-2026-41268)
Flowise contains a critical unauthenticated remote command execution vulnerability exploitable via a parameter override bypass using the FILE-STORAGE:: keyword combined with NODE_OPTIONS environment variable injection...
Fixed in 3.1.0
Remote code execution via prompt injection in Flowise Airtable Agent (CVE-2026-41265)
The `run` method of the `Airtable_Agents` class in Flowise evaluates an LLM-generated Python script without proper sandboxing. An unauthenticated remote attacker who can send prompts to a chatflow using the Airtable A...
Fixed in 3.1.0
Heap buffer overflow in Linux kernel batman-adv TT response handling (CVE-2026-31659)
The batman-adv subsystem in the Linux kernel computes the allocation length for a global translation table (TT) response using 16-bit temporaries. A remote originator advertising a sufficiently large global TT can cau...
Fixed in 6.17.0-1018.18; 6.17.0-1019.19; 6.17.0-1020.22; 6.17.0-40.40
Routing cache isolation flaw in Linux kernel seg6 lwtunnel (CVE-2026-31668)
The seg6 lwtunnel in the Linux kernel shares a single dst_cache between the seg6_input_core() and seg6_output_core() paths. Because these paths can perform post-encapsulation SID lookups under different routing contex...
Fixed in linux-image-6.17.0-1018-oracle-64k 6.17.0-1018.18; linux-image-6.17.0-1019-aws 6.17.0-1019.19; linux-image-6.17.0-1019-aws-64k 6.17.0-1019.19; linux-image-6.17.0-1020-gcp 6.17.0-1020.22; linux-image-6.17.0-1020-gcp-64k 6.17.0-1020.22; linux-image-6.17.0-40-generic 6.17.0-40.40
SQL injection in Saltcorn mobile-sync endpoints (CVE-2026-41478)
A SQL injection vulnerability in Saltcorn's mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL by supplying malicious values in sync parameter...
Fixed in 1.4.6; 1.5.6; 1.6.0-beta.5
Middleware route protection bypass in Clerk JavaScript SDK packages (CVE-2026-41248)
The `createRouteMatcher` function in `@clerk/nextjs`, `@clerk/nuxt`, and `@clerk/astro` can be bypassed by certain crafted requests, allowing those requests to skip middleware gating and reach downstream handlers such...
Fixed in @clerk/astro 1.5.7, 2.17.10, 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, 7.2.1; @clerk/nuxt 1.13.28, 2.2.2; @clerk/shared 2.22.1, 3.47.4, 4.8.1
Invalid MAC header access in Linux kernel netfilter ip6t_eui64 (CVE-2026-31685)
In the Linux kernel netfilter subsystem, the `eui64_mt6()` function in `ip6t_eui64` fails to reject packets with an invalid MAC header when `par->fragoff == 0`, allowing the code to reach `eth_hdr(skb)` without a vali...
Fixed in linux-image-6.17.0-1018-oracle-64k 6.17.0-1018.18; linux-image-6.17.0-1019-aws 6.17.0-1019.19; linux-image-6.17.0-1019-aws-64k 6.17.0-1019.19; linux-image-6.17.0-1020-gcp 6.17.0-1020.22; linux-image-6.17.0-1020-gcp-64k 6.17.0-1020.22; linux-image-6.17.0-40-generic 6.17.0-40.40
Header injection via incomplete CVE-2025-27636 fix in Apache Camel (CVE-2026-40453)
The fix for CVE-2025-27636 applied case-insensitive header filtering only to HttpHeaderFilterStrategy, leaving five non-HTTP implementations (JmsHeaderFilterStrategy, ClassicJmsHeaderFilterStrategy, SjmsHeaderFilterSt...
Fixed in 4.14.6; 4.18.2; 4.20.0
Deserialization fix bypass via DefaultExchangeHolder in Apache Camel JMS (CVE-2026-40860)
The post-deserialization class allowlist introduced to fix CVE-2026-40860 in Apache Camel's JMS components can be bypassed by wrapping a crafted payload inside a `DefaultExchangeHolder` object, which resides in the al...
Fixed in 4.21.0
Message header injection in Apache Camel camel-mail component (CVE-2026-33454)
The Camel-Mail component's custom header filter strategy (MailHeaderFilterStrategy) filters only the outbound direction and leaves the inbound direction unconfigured, allowing Camel-prefixed MIME headers from incoming...
Fixed in 4.14.6; 4.18.1; 4.19.0
Header injection leading to remote code execution in Apache Camel camel-coap (CVE-2026-33453)
The camel-coap component in Apache Camel maps incoming CoAP request URI query parameters directly into Camel Exchange message headers without applying any HeaderFilterStrategy, allowing injection of arbitrary Camel in...
Fixed in 4.14.6; 4.18.1; 4.19.0
Unauthenticated remote code execution in DocsGPT MCP STDIO configuration (CVE-2026-26015)
DocsGPT's MCP connection test endpoint fails to restrict the `transport_type` parameter, allowing an unauthenticated attacker to supply `transport_type=stdio` alongside a crafted command payload. The server passes the...
Fixed in 0.16.0
SSRF and RCE via PHP wrapper in PhpSpreadsheet IOFactory::load (CVE-2026-34084)
PhpSpreadsheet's `File::assertFile` helper uses PHP's `is_file()` to validate filenames passed to `IOFactory::load`, but `is_file()` processes PHP stream wrappers such as `phar://`, `ftp://`, and `ssh2.sftp://`. When ...
Fixed in 5.6.0; 3.10.4; 2.4.4; 2.1.15; 1.30.3
SQL injection in Emlog article creation and update functions (CVE-2026-42287)
Emlog versions prior to 2.6.11 contain a SQL injection vulnerability in the `addLog()` and `updateLog()` methods of `/include/model/log_model.php`, where user-supplied article data fields are concatenated directly int...
Fixed in 2.6.11
Arbitrary code execution in Postiz pr-docker-build.yml workflow (CVE-2026-42298)
A "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (`.github/workflows/pr-docker-build.yml`) allows any unauthenticated attacker to execute arbitrary code during the Docker build process b...
Fixed in >= 0
Stored XSS in Postiz public post preview page (CVE-2026-42556)
Authenticated users of Postiz can inject arbitrary HTML into post content by tampering save requests, then distribute the public preview link (/p/<postId>?share=true) to other users. The preview page renders the store...
Fixed in >= 2.21.7
Missing authentication on PFD-management API in free5GC NEF (CVE-2026-44315)
free5GC's Network Exposure Function (NEF) mounts the `3gpp-pfd-management` route group without inbound OAuth2/bearer-token authorization, accepting arbitrary or forged bearer tokens. An attacker with network access to...
Fixed in v4.2.2