Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Argument injection in BuildKit Git source checkout via bundle file (CVE-2026-15793)
BuildKit custom frontends or clients using the raw low-level API can enable `git.checkoutbundle=true` when checking out Git sources. A malicious Git source can exploit this to cause a crafted command invocation on the...
Fixed in v0.31.2+
Cross-workspace IDOR and privilege escalation in PraisonAI Platform (CVE-2026-47407)
PraisonAI Platform's `require_workspace_member` dependency validates only that the caller belongs to the workspace ID in the URL prefix, but route handlers retrieve nested resources (agents, issues, projects, labels, ...
Fixed in >= 0.1.4
Denial of service in React Server DOM bundler packages (CVE-2026-44907)
A denial of service vulnerability exists in the React server DOM packages for webpack, Parcel, and Turbopack. Sending specially crafted HTTP requests to server function endpoints can trigger out-of-memory exceptions o...
Fixed in 19.0.8; 19.1.9; 19.2.8
Arbitrary file read in PraisonAI MCP server handlers (CVE-2026-47394)
An incomplete fix for CVE-2026-44336 leaves three path-handling MCP tools (`praisonai.workflow.show`, `praisonai.workflow.validate`, `praisonai.deploy.validate`) in `mcp_server/adapters/cli_tools.py` without path cont...
Fixed in >= 4.6.40
Server-Side Request Forgery in Apache Syncope Connectors and Resources check (CVE-2026-62418)
Apache Syncope contains a Server-Side Request Forgery (SSRF) vulnerability accessible to low-privileged authenticated users via the Connectors and Resources check functionality. An attacker with minimal privileges cou...
Fixed in 4.0.7; 4.1.2
Groovy sandbox bypass enabling RCE in Apache Syncope (CVE-2026-63071)
Apache Syncope contains an Improper Isolation or Compartmentalization vulnerability in its Groovy security sandbox. An administrator with adequate entitlements for Implementations can create a malicious Groovy class c...
Fixed in 4.0.7; 4.1.2
Remote code execution via unsandboxed Groovy scriptTask in Apache Syncope (CVE-2026-53405)
Apache Syncope contains an improper isolation vulnerability in its Flowable BPMN extension that allows an administrator with adequate entitlements to import arbitrary BPMN process definitions via the REST API. When a ...
Fixed in 4.0.7; 4.1.2
Remote code execution via scripted connector in Apache Syncope (CVE-2026-53421)
Apache Syncope contains an improper isolation or compartmentalization vulnerability in its connector subsystem. An administrator with adequate entitlements can achieve remote code execution by exploiting scripted conn...
Fixed in 4.0.7; 4.1.2
Prototype pollution in nevware21/ts-utils objDeepCopy/objCopyProps (CVE-2026-46681)
The `_copyProps` function in `@nevware21/ts-utils` iterates object properties using `for...in` without an `Object.hasOwnProperty` check and does not filter dangerous keys such as `__proto__`, `constructor`, and `proto...
Fixed in 0.14.0
CPU exhaustion via regex backtracking in Perl HTTP::Date (CVE-2026-14741)
HTTP::Date versions before 6.08 for Perl contain inefficient regular expression complexity (CWE-1333) in the `parse_date()` function, where unbounded quantifiers placed adjacently before a trailing anchor cause polyno...
Fixed in 6.08
Authorization token leakage in GitHub CLI attestation and release verify commands (CVE-2026-48501)
GitHub CLI incorrectly attaches authentication tokens to outgoing HTTP requests made to TUF repository mirrors during `gh attestation`, `gh release verify`, and `gh release verify-asset` operations. A flawed host norm...
Fixed in v2.93.0
Out-of-bounds read in Apache Fory zero-copy Java deserialization (CVE-2026-64609)
Apache Fory contains an out-of-bounds read vulnerability via `sun.misc.Unsafe` in its zero-copy deserialization path. When out-of-band zero-copy deserialization is enabled, the `readAlignedVarUint()` method can read b...
Fixed in 1.4.0
Heap type confusion and out-of-bounds read/write in Apache Fory C++ (CVE-2026-64608)
Apache Fory's C++ implementation contains a heap type confusion and out-of-bounds read/write vulnerability in its compatible-mode deserialization logic. Field-skip paths fail to validate declared field types against a...
Fixed in 1.4.0
Remote code execution via unrestricted callable in Grav CMS (CVE-2026-65008)
Grav's Blueprint::dynamicData() passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. An authenticated account with the admin.pages or api.pages.write permi...
Fixed in 2.0.7
Missing authorization on API key generation in Grav API plugin (CVE-2026-65007)
The Grav api plugin (grav-plugin-api) fails to properly authorize API key generation and revocation requests. The plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks before Grav's account-management ACL ...
Fixed in 1.0.8
Use-after-free in Apache Fory Rust deserialization (CVE-2026-60080)
A use-after-free vulnerability exists in the Rust deserialization logic of Apache Fory (fory-core). A crafted Fory payload can trigger undefined behavior, a process crash, or potential memory disclosure. Users are rec...
Fixed in 1.4.0
Class-registration bypass in Apache Fory Java lambda deserialization (CVE-2026-64606)
Apache Fory contains a deserialization of untrusted data vulnerability that allows class-registration checks to be bypassed during Java lambda deserialization. Only the lambda capture class is affected. An attacker ab...
Fixed in 1.4.0
Arbitrary file upload in MapSVG plugin for WordPress (CVE-2026-1771)
The MapSVG plugin for WordPress contains a missing file type validation flaw in the SVGFile constructor, caused by an incorrect conditional check that prevents validation from executing. Authenticated attackers with A...
Fixed in 8.14.1
Unauthenticated privilege escalation in Easy Form Builder for WordPress (CVE-2026-13439)
The Easy Form Builder by WhiteStudio plugin for WordPress contains a flaw in its password recovery flow whereby the publicly-visible session identifier ('sid') is used as the password reset token. Combined with a publ...
Fixed in 4.0.12
SPDY zlib header decompression amplification DoS in Netty (CVE-2026-55833)
Netty's SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated. A remote unauthenticated peer can send a small co...
Fixed in 4.2.16.Final; 4.1.136.Final