Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 397 total.
Command injection in Tenable Security Center via Analysis REST endpoint (CVE-2026-64878)
CVE-2026-64878 is a command injection vulnerability in Tenable Security Center in which unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling. A low-privileged, r...
Fixed in SC202607.1
SQL injection in Tenable Security Center ticketing REST API (CVE-2026-64877)
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API of Tenable Security Center to access sensitive data stored in the appliance database. The vulnerability is rated High severity...
Fixed in SC202607.1
Cross-workspace IDOR and privilege escalation in PraisonAI Platform (CVE-2026-47407)
PraisonAI Platform's `require_workspace_member` dependency validates only that the caller belongs to the workspace ID in the URL prefix, but route handlers retrieve nested resources (agents, issues, projects, labels, ...
Fixed in >= 0.1.4
Groovy sandbox bypass enabling RCE in Apache Syncope (CVE-2026-63071)
Apache Syncope contains an Improper Isolation or Compartmentalization vulnerability in its Groovy security sandbox. An administrator with adequate entitlements for Implementations can create a malicious Groovy class c...
Fixed in 4.0.7; 4.1.2
Remote code execution via unsandboxed Groovy scriptTask in Apache Syncope (CVE-2026-53405)
Apache Syncope contains an improper isolation vulnerability in its Flowable BPMN extension that allows an administrator with adequate entitlements to import arbitrary BPMN process definitions via the REST API. When a ...
Fixed in 4.0.7; 4.1.2
Remote code execution via scripted connector in Apache Syncope (CVE-2026-53421)
Apache Syncope contains an improper isolation or compartmentalization vulnerability in its connector subsystem. An administrator with adequate entitlements can achieve remote code execution by exploiting scripted conn...
Fixed in 4.0.7; 4.1.2
Authorization token leakage in GitHub CLI attestation and release verify commands (CVE-2026-48501)
GitHub CLI incorrectly attaches authentication tokens to outgoing HTTP requests made to TUF repository mirrors during `gh attestation`, `gh release verify`, and `gh release verify-asset` operations. A flawed host norm...
Fixed in v2.93.0
Out-of-bounds read in Apache Fory zero-copy Java deserialization (CVE-2026-64609)
Apache Fory contains an out-of-bounds read vulnerability via `sun.misc.Unsafe` in its zero-copy deserialization path. When out-of-band zero-copy deserialization is enabled, the `readAlignedVarUint()` method can read b...
Fixed in 1.4.0
Heap type confusion and out-of-bounds read/write in Apache Fory C++ (CVE-2026-64608)
Apache Fory's C++ implementation contains a heap type confusion and out-of-bounds read/write vulnerability in its compatible-mode deserialization logic. Field-skip paths fail to validate declared field types against a...
Fixed in 1.4.0
Remote code execution via unrestricted callable in Grav CMS (CVE-2026-65008)
Grav's Blueprint::dynamicData() passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. An authenticated account with the admin.pages or api.pages.write permi...
Fixed in 2.0.7
Class-registration bypass in Apache Fory Java lambda deserialization (CVE-2026-64606)
Apache Fory contains a deserialization of untrusted data vulnerability that allows class-registration checks to be bypassed during Java lambda deserialization. Only the lambda capture class is affected. An attacker ab...
Fixed in 1.4.0
Unauthenticated privilege escalation in Easy Form Builder for WordPress (CVE-2026-13439)
The Easy Form Builder by WhiteStudio plugin for WordPress contains a flaw in its password recovery flow whereby the publicly-visible session identifier ('sid') is used as the password reset token. Combined with a publ...
Fixed in 4.0.12
OS command injection via incomplete fix in AVideo execAsync() (CVE-2026-64625)
AVideo's patch for CVE-2026-45578 introduced escapeshellarg() per token in plugin/Live/on_publish.php, but the shared helper execAsync() re-embeds the assembled command inside an outer double-quoted sh -c invocation. ...
Fixed in >= 29.0
Cleartext SFTP credential exposure in VSee Clinic and VSee Clinic API (CVE-2026-13380)
VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 expose cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints when SFTP connections have been configured in the application. No authentication ...
Fixed in VSee Clinic 7.1.26.1; VSee Clinic API 1.3.0.1
Privilege escalation and information disclosure in RT REST 2.0 API (CVE-2026-44231)
An information disclosure and privilege escalation vulnerability exists in the REST 2.0 API of RT, an open source issue and ticket tracking system. A privileged but non-administrative user can obtain authentication cr...
Fixed in 5.0.10; 6.0.3
Unauthenticated file upload in Joomla extension jDownloads (CVE-2026-61900)
jDownloads versions 4.1.0 through 4.1.5 ship a standalone upload script (`administrator/components/com_jdownloads/assets/upload/upload-handler.php`) that runs outside Joomla's normal request flow with no authenticatio...
Fixed in 4.1.6
Stack-based buffer overflow in rsyslog mmpstrucdata module (CVE-2026-61548)
A stack-based buffer overflow exists in rsyslog's optional mmpstrucdata module, where parseSD_PARAM() allocates a fixed 32,768-byte stack buffer and passes it to parsePARAM_VALUE() without a size bound, allowing attac...
Fixed in rsyslog 8.2606.0
Stored XSS via user registration in Chamilo LMS (CVE-2026-39878)
A stored cross-site scripting vulnerability in the user registration form of Chamilo LMS allows any unauthenticated attacker to inject arbitrary JavaScript that executes in an administrator's browser session. The vuln...
Fixed in 1.11.40
Unsafe callable deserialization and RBAC context injection in Wazuh Cluster DAPI (CVE-2026-28220)
Two vulnerabilities in Wazuh's Cluster Distributed API (DAPI) allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to cause the master node to deserialize an att...
Fixed in 4.14.5
TLS hostname verification bypass in lettre boring-tls backend (CVE-2026-46428)
An inverted-boolean bug in lettre's boring-tls integration causes TLS hostname verification to be silently disabled when callers use the default strict configuration. An on-path attacker presenting any chain-valid cer...
Fixed in >=0.11.22