Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 397 total.
Privilege escalation via self-service REST API in Apache Syncope (CVE-2026-62183)
An improper privilege management vulnerability in Apache Syncope allows an authenticated user to escalate their own privileges via a REST API call. Under certain workflow adapter configurations, a user can assign them...
Fixed in 4.0.7; 4.1.2
SQL injection in Apache Syncope Audit Events search (CVE-2026-57308)
Apache Syncope contains an SQL injection vulnerability in its Audit Events search functionality. An administrator with adequate entitlements can execute arbitrary SQL via stacked queries by leveraging unsanitized sort...
Fixed in 4.0.7; 4.1.2
Missing authorization on ApprovalInbox GET routes in Network-AI (CVE-2026-64622)
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, allowing unauthenticated actors to retrieve full Ap...
Fixed in 5.13.4
TOCTOU race condition in SurrealDB HTTP RPC endpoint (CVE-2026-63756)
SurrealDB's HTTP /rpc endpoint contains a time-of-check/time-of-use (TOCTOU) race condition in which concurrent requests share mutable authentication state. An unauthenticated request racing against an active authenti...
Fixed in 3.1.0
SurrealQL injection in SurrealDB export command (CVE-2025-71392)
SurrealDB's command-line export command fails to properly escape table and field names, enabling SurrealQL injection in exported backup files. An authenticated System User with OWNER or EDITOR roles can craft maliciou...
Fixed in 2.0.5; 2.1.5; 2.2.2
Path restriction bypass in @fastify/http-proxy (CVE-2026-16117)
@fastify/http-proxy fails to rewrite the request prefix when percent-encoded characters are used in the prefix portion of the URL. Because Fastify's router URL-decodes paths for route matching while request.url retain...
Fixed in 11.6.0
Path traversal in @fastify/http-proxy WebSocket upstream routing (CVE-2026-15631)
@fastify/http-proxy fails to validate the resolved WebSocket destination path against the configured rewrite prefix, because the WebSocket upstream target is built with the WHATWG URL constructor, which performs RFC-3...
Fixed in >= 11.6.0
URL cache key collision in @fastify/reply-from (CVE-2026-16158)
CVE-2026-16158 is a URL cache key collision vulnerability in @fastify/reply-from. The plugin constructs internal cache keys by concatenating the destination and source path without a delimiter, allowing different (des...
Fixed in 12.6.4
REST API batch endpoint route confusion in WordPress (CVE-2026-63030)
CVE-2026-63030 is a route confusion flaw in the WordPress REST API batch endpoint (/wp-json/batch/v1) that causes two parallel tracking arrays to fall out of step when a sub-request errors, allowing a subsequent reque...
Fixed in 6.9.5; 7.0.2
Message corruption in the websocket-driver npm package (CVE-2026-54466)
CVE-2026-54466 is a message corruption vulnerability in the websocket-driver npm package affecting draft versions of the WebSocket protocol implementation. A remote, unauthenticated client can send an indefinite seque...
Fixed in >= 0.7.5
Hard-coded credentials in IBM Langflow OSS (CVE-2026-13446)
IBM Langflow OSS contains hard-coded credentials (such as a password or cryptographic key) used for inbound authentication, outbound communication to external components, or encryption of internal data. Specifically, ...
Fixed in 1.10.2
Unauthenticated remote code execution in IBM Langflow (CVE-2026-13448)
IBM Langflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint (/api/v1/build_public_tmp/{flow_id}/flow). The vulnerability originates from an incomplete denylist in...
Fixed in 1.10.2
Heap-based buffer overflow in IBM Storage Protect Client (CVE-2026-13473)
IBM Storage Protect Client contains a heap-based buffer overflow vulnerability caused by improper bounds checking in string copy operations. A remote unauthenticated attacker could exploit this flaw to execute arbitra...
Fixed in 8.2.1.2
Cross-site scripting (CWE-79) in IBM Engineering AI Hub (CVE-2026-15091)
CVE-2026-15091 is a cross-site scripting (CWE-79) vulnerability in IBM Engineering AI Hub caused by improper neutralization of input during web page generation. A remote attacker could exploit this flaw to execute arb...
Fixed in 1.3.0
Remote code execution via unsafe pickle deserialization in Langflow OSS (CVE-2026-8476)
CVE-2026-8476 is a critical remote code execution vulnerability in the disk-based caching mechanism of Langflow OSS. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects ...
Fixed in 1.10.1
Remote code execution in Langflow code validation API (CVE-2026-8481)
CVE-2026-8481 is a critical remote code execution vulnerability in the Langflow OSS code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly usin...
Fixed in 1.10.1
Authentication bypass in IBM Langflow OSS (CVE-2026-8505)
CVE-2026-8505 is an authentication bypass vulnerability in IBM Langflow OSS whereby the webhook endpoint incorrectly skips API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False, which is the de...
Fixed in 1.10.1
Path traversal in IBM Langflow OSS APIRequest component (CVE-2026-8859)
A path traversal vulnerability exists in the APIRequest component of IBM Langflow OSS when the "Save to File" feature is enabled. Filenames extracted from HTTP response Content-Disposition headers are not sanitized be...
Fixed in 1.10.1
Code injection in IBM Langflow OSS Python Interpreter (CVE-2026-8635)
CVE-2026-8635 is a code injection vulnerability (CWE-94) in IBM Langflow OSS affecting the Python Interpreter component. Authenticated users can execute arbitrary Python code via the PythonREPLComponent due to insuffi...
Fixed in 1.10.1
Stored XSS in Roundcube Webmail (CVE-2026-54433)
CVE-2026-54433 is a zero-click stored cross-site scripting (XSS) vulnerability in Roundcube Webmail's plain-text rendering component. The vulnerability was reported by Bohdan Kurinnoy of Samsung R&D Institute Ukraine ...
Fixed in 1.6.17; 1.7.2