Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Resource exhaustion via unbounded SPDY SETTINGS map in Netty (CVE-2026-55831)
Netty's SPDY SETTINGS decoder accepts a peer-declared entry count up to the 24-bit frame-length limit and materializes every unique setting ID into a TreeMap-backed DefaultSpdySettingsFrame without an implementation-l...
Fixed in 4.2.16.Final; 4.1.136.Final
OS command injection via incomplete fix in AVideo execAsync() (CVE-2026-64625)
AVideo's patch for CVE-2026-45578 introduced escapeshellarg() per token in plugin/Live/on_publish.php, but the shared helper execAsync() re-embeds the assembled command inside an outer double-quoted sh -c invocation. ...
Fixed in >= 29.0
Cross-agent authorization bypass in AgenticMail API (CVE-2026-57494)
A low-privileged authenticated AgenticMail agent can enumerate another agent's pending and claimed tasks by supplying the target agent name to `GET /api/agenticmail/tasks/pending?assignee=<name>`, disclosing task IDs ...
Fixed in 0.9.64
Missing sender authentication in AgenticMail inbound mail bridge-wake handler (CVE-2026-57495)
In AgenticMail, the bridge-wake inbound mail handler resumes the operator's Claude Code session with `permissionMode: 'bypassPermissions'` without verifying that the sending address belongs to the operator. Any extern...
Fixed in @agenticmail/claudecode 0.2.39; @agenticmail/codex 0.1.33; @agenticmail/core 0.9.43; @agenticmail/openclaw 0.5.71
Input validation and SQL injection flaws in AgenticMail API and Core (CVE-2026-47255)
Multiple improper input validation and SQL injection vulnerabilities affect the AgenticMail API and Core packages, allowing unauthenticated remote attackers to manipulate SQL commands, bypass storage ownership checks,...
Fixed in @agenticmail/api 0.9.32; @agenticmail/core 0.9.10
BOLA/IDOR in NextCRM MCP campaign tools (CVE-2026-55544)
Multiple MCP campaign tool handlers in NextCRM fail to enforce object-level authorization, ignoring the authenticated user's identity when querying or mutating campaigns. A low-privileged authenticated user holding a ...
Fixed in 0.12.2
RBAC bypass in NextCRM MCP product tools (CVE-2026-55550)
In NextCRM version 0.12.1, the MCP product tools exposed via `/api/mcp/mcp` perform write operations on the shared CRM product catalog without enforcing role-based access controls. While normal server actions restrict...
Fixed in 0.12.3
Broken Object Level Authorization in NextCRM CRM contact and target endpoints (CVE-2026-47130)
NextCRM versions prior to 0.12.0 contain a Broken Object Level Authorization (BOLA/IDOR) vulnerability in the CRM contact and target update endpoints. The PATCH handlers verify only that a session exists, but fail to ...
Fixed in 0.12.0
Broken Access Control in NextCRM user activation Server Actions (CVE-2026-47129)
NextCRM versions prior to 0.12.0 contain a Broken Access Control vulnerability in the `activateUser` and `deactivateUser` Next.js Server Actions. The application verifies only that a session exists, without checking w...
Fixed in 0.12.0
Integer overflow in rsync compressed-token decoder enables remote memory disclosure (CVE-2026-44508)
The rsync receiver's compressed-token decoder accumulates a 32-bit signed counter without checking for overflow. A malicious sender can trigger this overflow and, with careful manipulation, extract data stored in memo...
Fixed in 3.4.3
Improper certificate validation in Apache MINA SSHD (CVE-2026-56624)
Apache MINA SSHD's server-side OpenSSH user certificate validation failed to check or validate the force-command and verify-required options that may be embedded in a user certificate. As a result, a user authenticati...
Fixed in 2.19.0; 3.0.0-M5
Path traversal in Apache MINA SSHD sshd-git on Windows (CVE-2026-56623)
A path traversal vulnerability in the sshd-git component of Apache MINA SSHD allows an authenticated remote user to access git repositories outside the configured server-side root directory when the server runs on Win...
Fixed in 2.19.0; 3.0.0-M5
Path traversal in Apache MINA SSHD sshd-scp component (CVE-2026-56452)
A path traversal vulnerability in the sshd-scp component of Apache MINA SSHD allows a malicious sender to supply filenames containing path components in SCP "C" or "D" commands. Because received filenames were not val...
Fixed in 2.19.0; 3.0.0-M5
Cleartext SFTP credential exposure in VSee Clinic and VSee Clinic API (CVE-2026-13380)
VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 expose cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints when SFTP connections have been configured in the application. No authentication ...
Fixed in VSee Clinic 7.1.26.1; VSee Clinic API 1.3.0.1
Insecure Direct Object Reference in VSee Clinic File API (CVE-2026-13381)
VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate...
Fixed in VSee Clinic 7.1.26.1; VSee Clinic API 1.3.0.1
Incomplete upload denylist enables authenticated RCE in FreeScout (CVE-2026-53593)
FreeScout's file upload denylist (`Helper::$restricted_extensions`) does not include the `.pht` extension, leaving the authenticated upload endpoint `POST /uploads/upload` (`SecureController@upload`) able to store `.p...
Fixed in 1.8.224
Unauthenticated conversation thread injection in FreeScout (CVE-2026-53591)
FreeScout's email ingestion command skips HMAC verification on the `In-Reply-To` header when the hash component is any length other than 16 characters, due to a backward-compatibility branch in `FetchEmails.php`. An u...
Fixed in 1.8.223
Privilege escalation and information disclosure in RT REST 2.0 API (CVE-2026-44231)
An information disclosure and privilege escalation vulnerability exists in the REST 2.0 API of RT, an open source issue and ticket tracking system. A privileged but non-administrative user can obtain authentication cr...
Fixed in 5.0.10; 6.0.3
Unauthenticated file upload in Joomla extension jDownloads (CVE-2026-61900)
jDownloads versions 4.1.0 through 4.1.5 ship a standalone upload script (`administrator/components/com_jdownloads/assets/upload/upload-handler.php`) that runs outside Joomla's normal request flow with no authenticatio...
Fixed in 4.1.6
Stack-based buffer overflow in rsyslog mmpstrucdata module (CVE-2026-61548)
A stack-based buffer overflow exists in rsyslog's optional mmpstrucdata module, where parseSD_PARAM() allocates a fixed 32,768-byte stack buffer and passes it to parsePARAM_VALUE() without a size bound, allowing attac...
Fixed in rsyslog 8.2606.0