Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Command injection via log_file_name parameter in stata-mcp (CVE-2026-47708)
The `log_file_name` parameter in the `stata_do` API and CLI of stata-mcp is interpolated directly into a Stata command string without sanitization, allowing an attacker to break out of the string context and inject ar...
Fixed in 1.17.3
Improper certificate validation in Gitea internal API HTTP client (CVE-2026-54481)
Gitea's internal API HTTP client hardcodes `InsecureSkipVerify = true` in its TLS configuration with no operator override, making it the only outbound TLS client in the codebase that cannot be configured to verify pee...
Fixed in 1.27.0
Stored XSS via unescaped option label in FOG Project inventory (CVE-2026-47687)
The `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` val...
Fixed in >= 1.5.10.1832; >= 1.6.0-beta.2313
Authorization bypass in Gitea pull request update API endpoint (CVE-2026-58443)
Gitea fails to re-apply a token's public-only restriction when the pull request update endpoint (`POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update`) operates on a private head repository. The publi...
Fixed in 1.27.0
Stored XSS in FOG Project via unauthenticated inventory service endpoint (CVE-2026-47685)
The unauthenticated inventory service endpoint (`/service/inventory.php`) in FOG accepts client-supplied values without sanitization and persists them directly to the database. The Host Management Inventory page subse...
Fixed in >= 1.5.10.1832; >= 1.6.0-beta.2313
Privilege escalation via Personal Access Token scope bypass in Gitea (CVE-2026-56654)
Gitea's API endpoint for creating Personal Access Tokens (`POST /users/{username}/tokens`) can be accessed using an existing token formatted as `Authorization: Basic <token>:x-oauth-basic`. The Basic auth handler sets...
Fixed in 1.27.0
Denial of service via decompression bomb and O(N²) concatenation in Gitea Debian package parser (CVE-2026-56755)
Gitea's Debian package registry parser decompresses control.tar.gz without any size limit, allowing a crafted 83 MB .deb file to expand to over 16 GB in memory during parsing. A second independent flaw concatenates De...
Fixed in 1.27.0
Remember-Me token theft session persistence in Gitea (CVE-2026-56750)
Gitea's Remember-Me authentication fails to invalidate an attacker's session when a stolen token is detected as compromised via hash mismatch. When the legitimate user's original token triggers a hash mismatch, Gitea ...
Fixed in 1.27.0
Uncontrolled memory allocation and leak in CImg Library `_load_analyze()` (CVE-2026-47667)
In CImg Library prior to version 4.0.0, the `_load_analyze()` function reads a `header_size` field from the first 4 bytes of an Analyze/NIfTI file and passes it directly to a heap allocation without bounding it agains...
Fixed in commit 6a69bf7
Command injection in Tenable Security Center audit file upload (CVE-2026-64879)
Tenable Security Center does not properly sanitize filenames supplied during audit file upload before using them in system command execution. An attacker can inject shell metacharacters into a supplied filename to ach...
Fixed in SC202607.1
Command injection in Tenable Security Center via Analysis REST endpoint (CVE-2026-64878)
CVE-2026-64878 is a command injection vulnerability in Tenable Security Center in which unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling. A low-privileged, r...
Fixed in SC202607.1
Blind SQL injection in Tenable Security Center (CVE-2026-64880)
Tenable Security Center contains a blind SQL injection vulnerability in which unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or paramet...
Fixed in SC202607.1
Branch protection bypass via PR retargeting in Gitea (CVE-2026-58439)
Gitea does not re-evaluate the `official` flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access can obtain an `official: true` approval against an unprotected branch...
Fixed in 1.27.0
SSRF and repository exfiltration via HTTP redirect bypass in Gitea (CVE-2026-57894)
Gitea validates the user-supplied URL before repository migration but passes the original URL to the Git command-line client, which follows HTTP redirects by default. A low-privileged authenticated user can supply a p...
Fixed in 1.27.0
Reflected XSS in DHIS2 OpenAPI HTML scope parameter (CVE-2026-55081)
The DHIS2 OpenAPI HTML endpoint reflects values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value can be rendered as active HTML or JavaScript i...
Fixed in 2.42.5.1; 2.43.0.1; 2.44 development branch after PR #24162
SQL injection in DHIS2 SqlView filter parameter (CVE-2026-55084)
A SQL injection vulnerability exists in the `filter` parameter of the DHIS2 `/api/sqlViews/{viewId}/data.json` API endpoint. An authenticated user with access to any SqlView can inject arbitrary SQL queries, with erro...
Fixed in 2.37-EOS (2026-06-09); 2.38-EOS (2026-06-09); 2.39-EOS (2026-06-09); 2.40.11.1; 2.40.12; 2.41.8.2; 2.42.5.1; 2.43.0.1; 2.44 development branch after PR #24162
Denial of service via malformed Host header in websocket-driver-ruby (CVE-2026-61666)
The websocket-driver-ruby library fails to catch `URI::InvalidURIError` exceptions raised when parsing a malformed `Host` header in WebSocket server mode. A remote client can exploit this by sending an invalid `Host` ...
Fixed in >= 0.8.2
SQL injection in Tenable Security Center ticketing REST API (CVE-2026-64877)
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API of Tenable Security Center to access sensitive data stored in the appliance database. The vulnerability is rated High severity...
Fixed in SC202607.1
Missing authorization in HumHub Space member management (CVE-2026-47657)
A missing authorization check in HumHub's Space member management controller allows any authenticated user to trigger the removal of all members from any Space, without regard to the user's own role or membership in t...
Fixed in 1.18.3
Arbitrary file write in PraisonAI Python API (CVE-2026-47397)
PraisonAI's `write_file` tool skips path validation when `workspace=None`, which is always the case in production. An attacker can host a webpage containing hidden metadata that instructs the agent to write attacker-c...
Fixed in >= 4.6.40