Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 397 total.
TOTP authentication bypass in Pingvin Share X (CVE-2026-44196)
Pingvin Share X contains a critical authentication bypass vulnerability in its two-factor authentication flow. An attacker who has obtained a valid username and password can skip the TOTP second-factor requirement ent...
Fixed in 1.16.3
Authentication bypass in Relay Server WebSocket endpoints (CVE-2026-42889)
Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incor...
Fixed in 0.9.7
Incomplete filesystem sandbox bypass in Pulpy pulpy.fs bridge (CVE-2026-44225)
Pulpy injects a pulpy.fs JavaScript API into every packaged web application, granting it access to the host filesystem via a validateFsPath() function intended to sandbox that access. The function's blocklist is incom...
Fixed in 0.1.1
Zip slip remote code execution in efw4.X (CVE-2026-44257)
efw.file.FileManager.unZip extracts zip entries without validating canonical paths, allowing directory traversal via crafted entry names such as `../../../pwned.jsp`. Combined with the framework's multipart /uploadSer...
Fixed in 4.08.010
Path traversal via unchecked dst parameter in efw4.X (CVE-2026-44258)
The elfinder_checkRisk function in efw4.X validates source path parameters (target and targets) for path traversal, but does not validate the dst (destination) parameter used by elfinder_paste. An attacker can supply ...
Fixed in 4.08.010
Authentication bypass via SSO header injection in SillyTavern (CVE-2026-44649)
SillyTavern accepts `Remote-User` (Authelia) and `X-Authentik-Username` (Authentik) HTTP headers to automatically log in users when SSO is configured, but does not validate that these headers originate from a trusted ...
Fixed in 1.18.0
Path traversal via sanitize-filename bypass in SillyTavern extensions API (CVE-2026-44650)
The `POST /api/extensions/delete` endpoint in SillyTavern validates the `extensionName` parameter before sanitizing it, allowing the special value `"."` to pass the non-empty check. The `sanitize-filename` library con...
Fixed in 1.18.0
Unauthenticated remote code execution in ChurchCRM setup wizard (CVE-2026-42288)
An incomplete fix for CVE-2026-39337 leaves ChurchCRM's setup wizard fully exploitable via an unsanitized DB_PASSWORD field. The raw user-supplied value is substituted directly into a PHP configuration template, allow...
Fixed in 7.3.2
Incomplete fix for authentication bypass in ChurchCRM public API (CVE-2026-44547)
The fix for CVE-2026-40582, which addressed 2FA bypass and account lockout bypass in ChurchCRM's public API login endpoint, was never delivered to users. The hardening commit was silently overwritten by an unrelated p...
Fixed in 7.3.1
Hard-coded cryptographic key enabling unauthenticated RCE in Apache OFBiz (CVE-2026-31986)
Apache OFBiz contains a hard-coded cryptographic key used for JWT signing. An unauthenticated attacker can exploit this alongside widget template injection to achieve remote code execution. All versions before 24.09.0...
Fixed in 24.09.06
LDAP injection authentication bypass in Apache OFBiz (CVE-2026-41919)
An LDAP injection vulnerability in Apache OFBiz allows improper neutralization of special elements used in LDAP query DN construction, resulting in an authentication bypass. This issue poses a moderate-severity risk t...
Fixed in 24.09.06
Server-Side Template Injection in Tugtainer notification templates (CVE-2026-47752)
Tugtainer versions through 1.28.3 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are rendered using an unsandboxed `jinja2...
Fixed in v1.30.2
DeserializationPolicy bypass in Apache Fory PyFory ReduceSerializer (CVE-2026-48207)
PyFory's ReduceSerializer fails to enforce DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution when operating in Python-native mode with strict mode disabled. Applications...
Fixed in 1.0.0
Path traversal in ocaml-tar allows arbitrary file write (CVE-2026-45390)
A path traversal vulnerability in ocaml-tar allows a maliciously crafted archive containing `../` path segments to escape the intended extraction directory. The `Tar_unix.extract` function passes unsanitized filenames...
Fixed in 3.5.0
Authentication bypass and account takeover in ThingsBoard (CVE-2026-36537)
ThingsBoard improperly trusts user-supplied identity data in the `user` parameter of the `/login/oauth2/code/` OAuth 2.0 authorization code exchange endpoint. A remote attacker can manipulate the email address in this...
Fixed in ThingsBoard v4.2.2.1; ThingsBoard v4.3.1.1
Predictable nonce in Dancer2::Plugin::Auth::OAuth for Perl (CVE-2026-11832)
Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a nonce generated using an MD5 hash of the epoch time, which is predictable. This constitutes use of a cryptographically weak pseudo-random number ...
Fixed in 0.22
Plaintext credential transmission in Avantra password reset mechanism (CVE-2026-8673)
Avantra's password re-initialization mechanism transmits passwords in plaintext, exposing credentials to network sniffing attacks. The vulnerability affects Avantra on Linux and Windows, with high impact to both confi...
Fixed in 25.3.x
Kotlin DSL sandbox escape code execution in JetBrains TeamCity (CVE-2026-65906)
A vulnerability in JetBrains TeamCity allows code execution via a Kotlin DSL sandbox escape. An attacker able to use the Kotlin DSL build configuration feature could escape the sandbox and execute arbitrary code on th...
Fixed in 2026.1.2; 2025.11.6
Code execution via Git VCS roots in JetBrains TeamCity (CVE-2026-65907)
JetBrains TeamCity contains a vulnerability that allows code execution through Git VCS roots. Exploitation of this issue could allow an attacker to execute arbitrary code within the TeamCity environment.
Fixed in 2026.1.2; 2025.11.6
Unauthorized input injection in JetBrains IntelliJ IDEA Remote Development (CVE-2026-64812)
JetBrains IntelliJ IDEA contains a vulnerability that allows unauthorized input injection during a Remote Development session. An attacker capable of exploiting this flaw could inject arbitrary input into the remote s...
Fixed in 2026.2