Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Authentication bypass and remote code execution in FUXA (CVE-2026-43945)
FUXA contains a path confusion flaw in its authentication middleware that allows unauthenticated remote attackers to bypass security checks by appending `?x=/socket.io` to requests targeting protected `/nodered/*` end...
Fixed in >= 1.3.1
Authorization bypass in FUXA /api/getTagValue endpoint (CVE-2026-43946)
An authorization bypass vulnerability in the FUXA SCADA/HMI platform allows unauthenticated users to retrieve arbitrary tag values via the /api/getTagValue endpoint. The flaw arises because the authorization check isA...
Fixed in >= 1.3.1
Unauthenticated remote code execution in FUXA via script test mode (CVE-2026-43947)
An authorization confused deputy vulnerability in FUXA allows unauthenticated attackers to execute arbitrary code on the server. The `POST /api/runscript` endpoint validates permissions against a stored script's ID, b...
Fixed in >= 1.3.1
Heap information disclosure in libheif grid image decoding (CVE-2026-47247)
Two chained bugs in libheif allow an attacker to leak process heap memory as visible pixel values in decoded grid images. An uninitialized pixel plane allocation (pixelimage.cc:684) combined with an integer-division g...
Fixed in v1.22.0
ByteBuf reference leak in Netty SpdyHttpDecoder causes native memory exhaustion (CVE-2026-56745)
The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec fails to release a pooled `ByteBuf` when a stream is terminated via `RST_STREAM` or when accumulated content exceeds `maxContentLength`, permanently leaking ...
Fixed in 4.2.16.Final; 4.1.136.Final
Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling (CVE-2026-10680)
The Classic Bluetooth (BR/EDR) L2CAP signaling handlers `l2cap_br_conf_req()` and `l2cap_br_conf_rsp()` in Zephyr incorrectly validate the per-command data length against the full PDU buffer length (`buf->len`) rather...
Fixed in 4.3.1; 4.5.0
NULL-pointer and out-of-bounds write in Zephyr MCTP I2C+GPIO target binding (CVE-2026-10678)
The MCTP-over-I2C+GPIO target binding in Zephyr fails to validate receive buffer allocation and bounds before writing in mctp_i2c_gpio_target_write_received(). An unauthenticated I2C bus controller can trigger a NULL-...
Fixed in 4.5.0
Unbounded memory exhaustion in Netty HAProxyMessageDecoder (CVE-2026-55851)
A signed-byte sentinel collision in Netty's `HAProxyMessageDecoder` (`codec-haproxy` module) causes the decoder to enter a perpetual version-detection loop when a PROXY protocol v2 stream contains version byte `0xFF`....
Fixed in 4.2.16.Final; 4.1.136.Final
Server-side request forgery in Gitea hostmatcher and OpenID sign-in (CVE-2026-58314)
Gitea's IP classifier in the `hostmatcher` module fails to block ten address families including CGNAT (100.64.0.0/10), allowing any authenticated user to direct webhook deliveries or repository migrations to internal ...
Fixed in 1.27.0
Quadratic-time denial of service in Gitea Locale middleware (CVE-2026-58436)
Gitea's Locale middleware passes the raw `Accept-Language` HTTP header to `golang.org/x/text/language.ParseAcceptLanguage` without imposing a size or character-class filter. The existing CVE-2022-32149 guard caps hyph...
Fixed in 1.27.0
Eval injection in Net::DNS via EDNS EXTENDED ERROR option (CVE-2026-64193)
Net::DNS versions through 1.55 for Perl contain an eval injection vulnerability in the parsing of the EXTRA-TEXT field of EDNS EXTENDED-ERROR options (RFC 8914). The `_decompose` method tokenises raw bytes and passes ...
Fixed in 1.56
Uncontrolled recursion denial of service in Net::DNS for Perl (CVE-2026-64194)
Net::DNS versions through 1.55 for Perl contain an uncontrolled recursion vulnerability in `Net::DNS::DomainName::decode`, which follows RFC 1035 DNS compression pointers without enforcing a depth limit. A remote atta...
Fixed in 1.56
Authenticated path traversal in HPE Aruba Networking EdgeConnect SD-WAN Gateways (CVE-2026-44878)
A path traversal vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways running ECOS allows a highly privileged, authenticated remote attacker to access the device's fi...
Fixed in ECOS 9.4.7.0 and above; ECOS 9.5.7.0 and above; ECOS 9.6.2.0 and above; ECOS 9.7.0.0 and above
Command injection in HPE Aruba Networking EdgeConnect SD-WAN Gateways CLI (CVE-2026-44879)
A command injection vulnerability in the CLI of HPE Aruba Networking EdgeConnect SD-WAN Gateways running ECOS allows a highly privileged, authenticated remote attacker to inject arbitrary commands via certain CLI oper...
Fixed in ECOS 9.4.7.0 and above; ECOS 9.5.7.0 and above; ECOS 9.6.2.0 and above; ECOS 9.7.0.0 and above; ECOS 9.4.5.0 (all builds) and above; ECOS 9.5.5.0 (all builds) and above; ECOS 9.6.0.0 (all builds) and above
Missing authentication for destructive operations in FOGProject fogproject (CVE-2026-47688)
The `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. `clearAES` wipes host AES encryption creden...
Fixed in 1.5.10.1832; 1.6.0-beta.2313
Command injection in MeltanoHub test_dispatcher GitHub Actions workflow (CVE-2026-47690)
The `test_dispatcher` GitHub Actions workflow in MeltanoHub unsafely interpolates attacker-controlled filenames into a shell command, enabling command injection. Because the workflow uses `pull_request_target`, it run...
Fixed in 923820d
Cross-tenant IDOR in Shelf asset tracking platform (CVE-2026-47697)
Shelf, a multi-tenant physical asset tracking platform, failed to verify that entity IDs supplied in requests belonged to the caller's organization. An authenticated user in one organization could read or modify anoth...
Fixed in 1.20.2
Repository visibility manipulation via undocumented git push options in Gitea (CVE-2026-58437)
Gitea's post-receive git hook handler accepts undocumented push options (`repo.private`, `repo.template`) that allow any user with owner or admin-collaborator access to silently toggle a repository's visibility and te...
Fixed in 1.27.0
Account deactivation bypass via OAuth2 sign-in in Gitea (CVE-2026-55987)
Gitea's OAuth2 sign-in callback incorrectly reactivates administrator-deactivated user accounts (`IsActive=false`) when the authentication source does not issue refresh tokens, such as GitHub or any OIDC/OAuth2 source...
Fixed in 1.27.0
SSRF protection bypass via NAT64 prefix in CC-Tweaked (CVE-2026-47695)
CC-Tweaked's HTTP API blocks requests to private network ranges to prevent server-side request forgery (SSRF), but this protection can be bypassed on IPv6-capable servers by addressing internal IPv4 services using NAT...
Fixed in 1.119.0