Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Denial of service in Tanium Server via file descriptor exhaustion (CVE-2026-9156)
A denial of service vulnerability exists in Tanium Server that allows an unauthenticated attacker with network access to craft messages that exhaust server file descriptors and memory. Successful exploitation could re...
Fixed in 2024H2 Release: Update 25 (Tanium Server v7.6.4.2190); 2025H1 Release: Update 19 (Tanium Server v7.7.3.8274); 2025H2 Release: Update 9 (Tanium Server v7.8.2.1176); 2026H1 Release: Update 0 (Tanium Server v7.8.4.1298)
Denial of service via configuration write access in IBM HTTP Server (CVE-2026-8856)
IBM HTTP Server 8.5 and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration. This vulnerability is classified as uncontrolled resource consu...
Fixed in 9.0.5.29; 8.5.5.30
Remote code execution and denial of service in IBM HTTP Server (CVE-2026-8855)
IBM HTTP Server 8.5 and 9.0 is vulnerable to remote code execution and denial of service when configured with TLS mutual authentication (client authentication). The vulnerability is classified as improper control of c...
Fixed in Fix Pack 9.0.5.29; Fix Pack 8.5.5.30
Code injection via 'path' parameter in Customer Support Ticket System & Helpdesk for WordPress (CVE-2026-15011)
The Customer Support Ticket System & Helpdesk WordPress plugin allows unauthenticated attackers to invoke arbitrary parameterless PHP functions via the 'path' parameter due to dynamic function invocation on an attacke...
Fixed in 6.0.6
Unauthenticated arbitrary file upload in GoDAM WordPress plugin (CVE-2026-14282)
The GoDAM plugin for WordPress contains insufficient file type validation in the `save_video_file()` function, which trusts the attacker-supplied multipart Content-Type header and moves uploads into a web-served direc...
Fixed in 2.0.0
Remote code execution in fastjson 1.2.68-1.2.83 (CVE-2026-16723)
A remote code execution vulnerability exists in fastjson 1.2.68 through 1.2.83, exploitable under the library's stock default configuration with no AutoType enablement and no classpath gadget required. The only deploy...
Fixed in fastjson 1.2.84
Unauthenticated SQL injection in Lumise Product Designer for WooCommerce (CVE-2026-9713)
The Lumise Product Designer for WooCommerce WordPress plugin is vulnerable to SQL injection via the 'id' and 'table' parameters in the cart JSON file processed by the checkout AJAX action. The 'id' field is interpolat...
Fixed in 2.1.2
Unauthenticated stored XSS in SUMO Reward Points for WooCommerce (CVE-2026-7534)
The SUMO Reward Points plugin for WordPress contains an unauthenticated stored cross-site scripting vulnerability in the REST API endpoint `/wp-json/wc-srp/v1/earning`. A flawed capability check in `SRP_REST_Earning_C...
Fixed in 32.8.0
Unauthenticated stored cross-site scripting in FormCraft WordPress plugin (CVE-2026-7232)
The FormCraft plugin for WordPress contains a stored cross-site scripting vulnerability affecting all versions up to and including 3.9.14. Unauthenticated attackers can inject arbitrary web scripts via matrix field su...
Fixed in 3.9.15
Server-Side Request Forgery in Next.js Server Actions on custom servers (CVE-2026-64649)
When a Server Action forwards or redirects a request in Next.js, an attacker who controls Host-associated headers can cause the server to issue outbound requests to an arbitrary host. In some configurations, this may ...
Fixed in 15.5.21; 16.2.11
Server-Side Request Forgery in Next.js rewrites via attacker-controlled hostname (CVE-2026-64645)
A vulnerability in Next.js allows rewrites() or redirects() rules that construct their external destination hostname from request-controlled input to be redirected to an arbitrary hostname, bypassing the configured ho...
Fixed in 15.5.21; 16.2.11
Authentication bypass in Eclipse Jetty Digest Authentication via ISO-8859-1 encoding (CVE-2026-10050)
The `DigestAuthentication.apply()` method in Eclipse Jetty's HTTP client uses ISO-8859-1 encoding to compute Digest authentication response hashes, silently replacing any character above U+00FF with the byte `0x3F` (`...
Fixed in 9.4.63; 10.0.31; 11.0.31; 12.0.36; 12.1.10
Middleware/proxy authentication bypass in Next.js App Router with Turbopack (CVE-2026-64642)
Next.js applications using App Router built with Turbopack and a single entry in `config.i18n.locales` are vulnerable to authentication bypass via crafted requests. An unauthenticated remote attacker can circumvent mi...
Fixed in 16.2.11
Infinite loop denial-of-service in Netty Bzip2Decoder (CVE-2026-59901)
The `Bzip2Decoder` handler in Netty's compression codec pipeline contains a flaw in the run-length encoding (RLE) state machine within `Bzip2BlockDecompressor.read()`. A remote attacker can send a malformed bzip2 stre...
Fixed in io.netty:netty-codec 4.1.136.Final; io.netty:netty-codec-compression 4.2.16.Final
OCSP response replay bypass in Netty OcspServerCertificateValidator (CVE-2026-56821)
`OcspServerCertificateValidator` in the `io.netty:netty-handler-ssl-ocsp` package fires a `VALID` `OcspValidationEvent` even after detecting an out-of-date OCSP response, because the freshness check lacks a `return` s...
Fixed in 4.2.16.Final; 4.1.136.Final
TOCTOU race condition in Netty OcspServerCertificateValidator (CVE-2026-56822)
Netty's OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent to downstream pipeline handlers before the asynchronous OCSP certificate revocation check completes. This creates a time-of-check to time...
Fixed in 4.2.16.Final; 4.1.136.Final
Authentication bypass in Check Point SmartConsole login process (CVE-2026-16232)
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative p...
Fixed in Jumbo Hotfix Accumulator for R82.10 starting from Take 36; Jumbo Hotfix Accumulator for R82 starting from Take 118; Jumbo Hotfix Accumulator for R81.20 starting from Take 158
Authentication bypass and privilege escalation in Check Point Security Management (CVE-2026-62144)
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management Server allows an unauthenticated remote attacker to execute arbitrary administrative commands on the Manag...
Fixed in Jumbo Hotfix Accumulator for R82.10 starting from Take 36; Jumbo Hotfix Accumulator for R82 starting from Take 118; Jumbo Hotfix Accumulator for R81.20 starting from Take 158
Sandbox bypass in Jenkins Script Security Plugin (CVE-2026-57280)
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type cast applied to each element of the iterated collection in a typed for loop, as the cast is performed during bytecode ...
Fixed in Script Security Plugin 1402.1405.vc96e74964250
Sandbox bypass via Groovy AST transformation annotation in Jenkins Script Security Plugin (CVE-2026-57281)
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, causing Groovy to load and e...
Fixed in Script Security Plugin 1402.1405.vc96e74964250