Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Authenticated remote code execution in Chamilo LMS (CVE-2026-34239)
An insufficient access control vulnerability in Chamilo LMS allows any authenticated user enrolled in a course (student, teacher, or DRH) to reach the `main/inc/ajax/lang.ajax.php` endpoint (`translate_portfolio_categ...
Fixed in 1.11.40
Unauthenticated access to legacy attachments in FreeScout (CVE-2026-48812)
FreeScout's attachment download route contains a logical flaw in its token validation check that unconditionally grants access to any attachment whose `token_type` is set to `TOKEN_TYPE_LEGACY` (value `1`), bypassing ...
Fixed in 1.8.221
Stored XSS via user registration in Chamilo LMS (CVE-2026-39878)
A stored cross-site scripting vulnerability in the user registration form of Chamilo LMS allows any unauthenticated attacker to inject arbitrary JavaScript that executes in an administrator's browser session. The vuln...
Fixed in 1.11.40
Payment validation bypass in Frappe LMS enrollment via unrelated batch (CVE-2026-39385)
Frappe LMS versions 2.51.0 and earlier allow a user to bypass payment validation for paid courses by enrolling through an unrelated batch. This vulnerability enables unauthorized access to paid course content without ...
Fixed in 2.52.0
Unauthenticated API and path traversal in WhatsApp MCP Server (CVE-2026-46555)
The whatsapp-bridge HTTP API in WhatsApp MCP Server listens on 127.0.0.1:8080 without authentication or Host header validation, and the /api/send endpoint accepts an absolute media_path parameter without restricting i...
Fixed in 0.2.1
SQL injection in syslog-ng SQL destination driver (CVE-2026-39879)
A missing sanitization call in `afsql_dd_run_query` allows SQL injection from an untrusted source in syslog-ng's SQL destination driver. This vulnerability is not present in default configurations; the SQL driver must...
Fixed in syslog-ng 4.12; syslog-ng Premium Edition 8.2; syslog-ng Store Box 7.8
Arbitrary recursive deletion via poisoned backup manifest in Network-AI (CVE-2026-58484)
Network-AI's `EnvironmentManager.pruneBackups()` reads backup entries from on-disk `_manifest.json` files and passes the untrusted `path` field directly to `rmSync()` with recursive and force options. An attacker who ...
Fixed in 5.12.2
API impersonation and missing object-level authorization in dataCycle-CORE (CVE-2026-32821)
In dataCycle-CORE, any authenticated API user can supply a `user_email` parameter to the collection API to evaluate permissions as a different user, potentially exposing that user's collections. In V4, the same contro...
Fixed in 26.06.08
Path traversal in dataCycle-CORE markdown renderer (CVE-2026-32820)
The documentation and static markdown renderer in dataCycle-CORE accepts attacker-controlled path segments and processes them only through the Rails HTML sanitizer, which does not strip directory traversal sequences. ...
Fixed in 26.06.08
Open redirect in dataCycle-CORE password reset and confirmation flows (CVE-2026-32824)
A low-privileged authenticated API user can supply attacker-controlled `forwardToUrl` and `redirectUrl` parameters when triggering password reset or account confirmation flows in dataCycle-CORE. These values are embed...
Fixed in 26.06.08
Integer overflow and heap buffer overflow in libvips vipsload operation (CVE-2026-33327)
The `vipsload` operation in libvips could incorrectly determine image dimensions, triggering an integer overflow that leads to a subsequent heap-based buffer overflow. An attacker able to supply a crafted image file m...
Fixed in >=8.18.1
Brute-force protection bypass on login endpoints in dataCycle-CORE (CVE-2026-32825)
dataCycle-CORE versions up to and including 25.07.3 accept unlimited password guesses against both the browser login endpoint (`/users/sign_in`) and the JSON API login endpoint (`/api/v4/auth/login`). Although Devise'...
Fixed in 26.06.08
Heap-based buffer overflow in libvips TIFF image decoding (CVE-2026-35591)
The `tiffload` operation in libvips could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible heap-based buffer overflow. An attacker able to supp...
Fixed in >=8.18.2
Unauthorized text file download via DataLink in dataCycle-CORE (CVE-2026-32807)
dataCycle-CORE contains a public route for downloading DataLink-attached text files that does not enforce link validity, expiry, or caller authentication. Any party in possession of a DataLink UUID - including recipie...
Fixed in 26.06.08
Unsafe callable deserialization and RBAC context injection in Wazuh Cluster DAPI (CVE-2026-28220)
Two vulnerabilities in Wazuh's Cluster Distributed API (DAPI) allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to cause the master node to deserialize an att...
Fixed in 4.14.5
TLS hostname verification bypass in lettre boring-tls backend (CVE-2026-46428)
An inverted-boolean bug in lettre's boring-tls integration causes TLS hostname verification to be silently disabled when callers use the default strict configuration. An on-path attacker presenting any chain-valid cer...
Fixed in >=0.11.22
UNC path traversal in Parsec Cloud workspace mountpoint (CVE-2026-25039)
Parsec Cloud does not sanitize workspace names before using them to create mountpoints on the Windows filesystem, allowing a workspace name containing a UNC path (e.g. `\\192.168.1.3\test`) to be evaluated as a networ...
Fixed in 3.3.3-rc.0
Authenticated RCE via malicious eTemplate upload in EGroupware (CVE-2026-40187)
An authenticated administrator can achieve OS-level remote code execution by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method in `api/src/Etemplate/W...
Fixed in 26.4.20260413; 23.1.20260601
Remote code execution via authorization bypass in EGroupware (CVE-2026-27823)
EGroupware contains an improper authorization check in `SmallPartMediaRecorder::ajax_upload()` that allows an attacker to bypass teacher-role verification by supplying a crafted `participant_role` value in request dat...
Fixed in 26.2.20260224; 23.1.20260224
Information exposure via unauthenticated share access in filebrowser (CVE-2026-46410)
An unauthenticated user can access shared content in a way that exposes sensitive information, including source and path details. This vulnerability allows unauthorized parties to obtain data that should be protected,...
Fixed in 1.3.2-stable; 1.4.1-beta