Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
SQL Injection in Kiteworks Secure Data Forms (CVE-2026-24782)
Multiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and so...
Fixed in 9.3.0
Code injection in DBI::Profile via Profile attribute (CVE-2026-14380)
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package, and arguments, and in...
Fixed in 1.650
Incorrect Authorization in PortProtonQt Polkit Rule (CVE-2026-59678)
A custom Polkit rule in PortProtonQt allows arbitrary local users to modify NetworkManager connections and mount/unmount file systems via UDisks2, due to an insecure command-line check that can be bypassed. This can l...
Fixed in 1.3.1
Code Injection in SMA1000 Appliance Management Console (CVE-2026-15410)
A post-authentication code injection vulnerability exists in the SMA1000 Appliance Management Console. Under specific conditions, a remote authenticated attacker with administrator privileges could execute arbitrary O...
Fixed in 12.4.3-03453; 12.5.0-02835
Local Privilege Escalation in Check Point Gaia Portal (CVE-2026-62145)
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges. This local privilege escalation could lead to full compromise...
Fixed in Jumbo Hotfix Accumulator for R82.10 starting from Take 36; Jumbo Hotfix Accumulator for R82 starting from Take 118; Jumbo Hotfix Accumulator for R81.20 starting from Take 158
Deserialization Vulnerability in Telerik UI for AJAX (CVE-2026-13190)
In Progress Telerik UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the PersistenceFramework allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote cod...
Fixed in 2026.2.708
Telerik UI for AJAX PersistenceFramework Cookie Deserialization Vulnerability (CVE-2026-13185)
In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote...
Fixed in 2026.2.708
Path Traversal and Deserialization in Telerik UI for AJAX (CVE-2026-13186)
A path traversal vulnerability in the file-based persistence storage provider of Progress Telerik UI for AJAX allows an attacker to influence which file is loaded as persistence state when the storage key is derived f...
Fixed in 2026.2.708
RadAsyncUpload Padding Oracle Vulnerability in Telerik UI for AJAX (CVE-2026-13182)
In Progress Telerik UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values...
Fixed in 2026.2.708
Stack Buffer Overflow in Unbound EDNS Report-Channel Processing (CVE-2026-55973)
When 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from an upstream response is processed, using the option's length as the length of the agent domain. If the agent domain is followed by ...
Fixed in 1.25.2
Cross-zone wildcard cache poisoning in Unbound (CVE-2026-44690)
Insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning in Unbound. A malicious actor controlling a single delegated z...
Fixed in 1.25.2
Heap Overflow in Unbound DNSCrypt TCP Handling (CVE-2026-40691)
A heap overflow vulnerability exists in Unbound when compiled with DNSCrypt support. A malicious DNSCrypt query over TCP causes the reply encryption routine to fail to bound the reply length against the destination bu...
Fixed in 1.25.2
Memory accounting bypass in Unbound downstream DoQ implementation (CVE-2026-32665)
In NLnet Labs Unbound versions 1.22.0 through 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection bypass the per-stream 'quic-size' gate, allowing a rem...
Fixed in 1.25.2
Open redirect and DOM-based XSS in Unblu Spark (CVE-2026-8152)
Unblu Spark contains an open redirect vulnerability via the redirectOnFailure parameter that can be escalated to DOM-based cross-site scripting (XSS). When deployed with com.unblu.identifier.siteEmbeddedSetup=true, th...
Fixed in 8.36.1-hotfix.0
SSO Instance-Role Provisioning Privilege Escalation in n8n (CVE-2026-65016)
n8n's Enterprise SSO instance-role provisioning does not prevent assignment of the global:owner role, allowing an SSO-authenticated user with a controlled instance-role claim to escalate privileges to instance owner. ...
Fixed in 1.123.64; 2.29.8; 2.30.1
Privilege Escalation via profile self-update in Grav Login plugin (CVE-2026-65603)
The Grav Login plugin versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler. Unlike the registration handler, it does not strip privilege fields ('groups','access') fr...
Fixed in 3.8.12
Local Privilege Escalation in Pi-hole via /etc/pihole/logrotate (CVE-2026-50130)
Pi-hole is a DNS sinkhole that protects devices from unwanted content. From version 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate, whi...
Fixed in 6.4.3
Out-of-bounds read in YAML::Syck for Perl (CVE-2026-57077)
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. A...
Fixed in 1.47
Hardcoded Credentials in Apache Solr BasicAuth Setup (CVE-2026-44825)
Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 contain hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable). A remote attacker can gain full administrative access to the cluster us...
Fixed in 9.11.0; 10.1.0
Negative chunk-size DoS in cpp-httplib (CVE-2026-45352)
A negative chunk-size in HTTP chunked Transfer-Encoding causes cpp-httplib to misinterpret the chunk size, leading to unbounded memory allocation and process crash. An unauthenticated remote attacker can exploit this ...
Fixed in 0.43.4