Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Authentication bypass in IBM WebSphere Application Server Liberty (CVE-2026-14525)
IBM WebSphere Application Server Liberty contains an authentication bypass vulnerability (CWE-306: Missing Authentication for Critical Function) that is triggered when the rtcomm-1.0 or rtcommGateway-1.0 feature is en...
Fixed in Liberty Fix Pack 26.0.0.9
File-access permission bypass in Vitest Browser Mode provider commands (CVE-2026-73653)
Several Browser Mode provider commands in Vitest accept browser-supplied file paths without enforcing the `allowWrite` permission gate or confining paths to the project root. A client able to reach the Browser Mode AP...
Fixed in 3.2.7; 4.1.10; 5.0.0-beta.6
Predictable SM2 key generation in sm-crypto via weak Node.js RNG (CVE-2026-73567)
The sm-crypto npm package's default `sm2.generateKeyPairHex()` path in Node.js seeds its module-wide SecureRandom instance (from jsbn) using `Math.random()` and `Date.getTime()` instead of a cryptographically secure s...
Fixed in 0.5.3
Git argument injection in Apache Allura (CVE-2026-73240)
Specifically crafted inputs may lead to git argument injection in Apache Allura. A remote attacker able to supply malicious input could exploit this vulnerability to inject arbitrary git arguments, potentially comprom...
Fixed in 1.19.1
Command and argument injection in rsync via unquoted peer- or host-controlled values (CVE-2026-53790)
rsync contains multiple injection vulnerabilities across four code paths - the RSYNC_CONNECT_PROG environment variable host substitution, daemon exec hook expansions, rsync-ssl hostspec handling, and remote-shell newl...
Fixed in 3.5.0
IP address spoofing in rsync daemon PROXY protocol handling (CVE-2026-53791)
When `proxy protocol = true` is configured, the rsync daemon (before 3.5.0) accepts PROXY protocol headers from clients connecting directly rather than through a trusted proxy. This allows unauthenticated remote attac...
Fixed in 3.5.0
Chroot inner-module escape via parent-component symlink in rsync (CVE-2026-53793)
rsync before 3.5.0 fails to properly confine paths when `use chroot = yes` is combined with a `/./ ` inner-module root: the kernel chroot constrains only the outer path, allowing a symlinked parent component inside th...
Fixed in 3.5.0
hosts deny access control bypass in rsync on DNS lookup failure (CVE-2026-70452)
rsync's `match_hostname()` function performs a forward DNS lookup of hostname tokens configured in `hosts deny` rules. When the lookup fails, the function returns "no match" - indistinguishable from a genuine non-matc...
Fixed in 3.5.0
Module-root escape via symlink in rsync daemon (CVE-2026-70460)
The rsync daemon resolves operator-supplied --partial-dir and --backup-dir option values by following symlinks that are owned by uid 0 or the daemon euid, without verifying that the resolved path remains within the mo...
Fixed in 3.5.0
Code injection remote code execution in Flowise Airtable Agent node (CVE-2026-73485)
Flowise contains a code injection vulnerability in the run method of the Airtable_Agents class, where user-supplied prompts can cause the application to execute attacker-controlled Python code in an unsandboxed pyodid...
Fixed in 3.1.3
Code injection in Flowise CSV Agent customReadCSV parameter (CVE-2026-73486)
Flowise contains a code injection vulnerability in the CSV Agent node's `customReadCSV` parameter, where user-supplied input is substituted directly into a Python script prior to execution in an unsandboxed pyodide en...
Fixed in 3.1.3
Prompt injection to RCE and SSRF via Python validator bypass in Flowise (CVE-2026-73487)
Flowise CSV Agent and Airtable Agent nodes use a regex-based blocklist to validate LLM-generated Python code before execution in Pyodide. The blocklist has multiple structural bypasses - most critically, pandas URL-fe...
Fixed in 3.1.3
vm2 JavaScript sandbox escape to RCE in Flowise (CVE-2026-73602)
Flowise contains a sandbox escape vulnerability in its vm2-based JavaScript execution environment, affecting the Custom Function and Custom Tool nodes. An authenticated attacker can craft a fake String object whose `m...
Fixed in 3.1.3
Remote code execution in Flowise Custom MCP Config Node (CVE-2026-73601)
Flowise deployments with CUSTOM_MCP_PROTOCOL set to stdio (the default setting) are vulnerable to remote code execution through the Custom MCP node, which uses the StdioClientTransport MCP client. Authenticated users ...
Fixed in 3.1.3
Missing authorization in SiYuan getAttributeViewSearchTarget endpoint (CVE-2026-73608)
The `/api/av/getAttributeViewSearchTarget` endpoint in SiYuan's development branch is registered with `CheckAuth` only and performs no authorization checks of any kind - no `CheckReadonly`, no publish-access gate, and...
Fixed in v3.7.4
Unauthenticated superuser registration and RCE in UpSnap (CVE-2026-49819)
UpSnap's `POST /api/upsnap/init-superuser` endpoint (`backend/pb/handlers.go:249`) lacks authentication, a setup token, an IP allow-list, and rate limiting. On any fresh installation, an unauthenticated network-adjace...
Fixed in >= 5.4.0
OS command injection in UpSnap device management (wake_cmd/shutdown_cmd) (CVE-2026-49481)
An OS command injection vulnerability exists in UpSnap's device management functionality due to unsafe shell command template interpolation of the `ip` and `mac` fields. User-controlled values are inserted into `wake_...
Fixed in >= 5.4.0
Cross-tenant DNS zone overlap in OpenStack Designate (CVE-2026-71193)
OpenStack Designate fails to enforce cross-pool zone ownership checks when scheduling a zone to a non-default pool via the attribute filter. An authenticated tenant can create a sub-zone, super-zone, or duplicate of a...
Fixed in 20.0.2
Fail-open authentication bypass in getkin/kin-openapi ValidationHandler (CVE-2026-73501)
ValidationHandler.Load() in the kin-openapi Go library unconditionally replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without performing any credential check. This causes every...
Fixed in v0.144.0
Hard-coded authentication secret in WolfStack allows unauthenticated remote code execution (CVE-2026-73519)
WolfStack compiled a single hard-coded cluster-authentication secret into every build, published as a constant in src/auth/mod.rs. Any remote unauthenticated attacker able to reach an affected node's management port c...
Fixed in 25.9.2