Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 263 total.
Unauthenticated SQL injection in Lumise Product Designer for WooCommerce (CVE-2026-9713)
The Lumise Product Designer for WooCommerce WordPress plugin is vulnerable to SQL injection via the 'id' and 'table' parameters in the cart JSON file processed by the checkout AJAX action. The 'id' field is interpolat...
Fixed in 2.1.2
Unauthenticated stored XSS in SUMO Reward Points for WooCommerce (CVE-2026-7534)
The SUMO Reward Points plugin for WordPress contains an unauthenticated stored cross-site scripting vulnerability in the REST API endpoint `/wp-json/wc-srp/v1/earning`. A flawed capability check in `SRP_REST_Earning_C...
Fixed in 32.8.0
Unauthenticated stored cross-site scripting in FormCraft WordPress plugin (CVE-2026-7232)
The FormCraft plugin for WordPress contains a stored cross-site scripting vulnerability affecting all versions up to and including 3.9.14. Unauthenticated attackers can inject arbitrary web scripts via matrix field su...
Fixed in 3.9.15
Server-Side Request Forgery in Next.js Server Actions on custom servers (CVE-2026-64649)
When a Server Action forwards or redirects a request in Next.js, an attacker who controls Host-associated headers can cause the server to issue outbound requests to an arbitrary host. In some configurations, this may ...
Fixed in 15.5.21; 16.2.11
Server-Side Request Forgery in Next.js rewrites via attacker-controlled hostname (CVE-2026-64645)
A vulnerability in Next.js allows rewrites() or redirects() rules that construct their external destination hostname from request-controlled input to be redirected to an arbitrary hostname, bypassing the configured ho...
Fixed in 15.5.21; 16.2.11
Authentication bypass in Eclipse Jetty Digest Authentication via ISO-8859-1 encoding (CVE-2026-10050)
The `DigestAuthentication.apply()` method in Eclipse Jetty's HTTP client uses ISO-8859-1 encoding to compute Digest authentication response hashes, silently replacing any character above U+00FF with the byte `0x3F` (`...
Fixed in 9.4.63; 10.0.31; 11.0.31; 12.0.36; 12.1.10
Middleware/proxy authentication bypass in Next.js App Router with Turbopack (CVE-2026-64642)
Next.js applications using App Router built with Turbopack and a single entry in `config.i18n.locales` are vulnerable to authentication bypass via crafted requests. An unauthenticated remote attacker can circumvent mi...
Fixed in 16.2.11
Infinite loop denial-of-service in Netty Bzip2Decoder (CVE-2026-59901)
The `Bzip2Decoder` handler in Netty's compression codec pipeline contains a flaw in the run-length encoding (RLE) state machine within `Bzip2BlockDecompressor.read()`. A remote attacker can send a malformed bzip2 stre...
Fixed in io.netty:netty-codec 4.1.136.Final; io.netty:netty-codec-compression 4.2.16.Final
OCSP response replay bypass in Netty OcspServerCertificateValidator (CVE-2026-56821)
`OcspServerCertificateValidator` in the `io.netty:netty-handler-ssl-ocsp` package fires a `VALID` `OcspValidationEvent` even after detecting an out-of-date OCSP response, because the freshness check lacks a `return` s...
Fixed in 4.2.16.Final; 4.1.136.Final
TOCTOU race condition in Netty OcspServerCertificateValidator (CVE-2026-56822)
Netty's OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent to downstream pipeline handlers before the asynchronous OCSP certificate revocation check completes. This creates a time-of-check to time...
Fixed in 4.2.16.Final; 4.1.136.Final
Sandbox bypass in Jenkins Script Security Plugin (CVE-2026-57280)
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type cast applied to each element of the iterated collection in a typed for loop, as the cast is performed during bytecode ...
Fixed in Script Security Plugin 1402.1405.vc96e74964250
Sandbox bypass via Groovy AST transformation annotation in Jenkins Script Security Plugin (CVE-2026-57281)
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, causing Groovy to load and e...
Fixed in Script Security Plugin 1402.1405.vc96e74964250
Query planner crash via $meta sort expression in MongoDB (CVE-2026-9737)
During query planning, MongoDB does not correctly handle the `$meta` expression when processing sort patterns in raw BSON object form. This leads to incorrect transformations that can trigger an invariant failure and ...
Fixed in 8.2.12; 8.0.28; 7.0.39; 8.3.7
Directory traversal file overwrite in OpenStack Ironic ISO handling (CVE-2026-48681)
A vulnerability in OpenStack Ironic's ISO handling code allows a maliciously crafted ISO image to cause path traversal, enabling arbitrary file overwrite on the Ironic conductor's disk. In the anaconda deploy interfac...
Fixed in 26.1.7; 29.0.6; 32.0.2; 35.0.2
Information disclosure via DBPointer handling in MongoDB server-side JavaScript (CVE-2026-13066)
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can cause internal process memory contents to be included in data returned to the client. This constitutes an...
Fixed in 7.0.39; 8.0.28; 8.2.12; 8.3.7; 9.0.0-rc1; 9.1.0-rc0
Denial of service via $linearFill window function in MongoDB (CVE-2026-13065)
A read-only user can craft an aggregation pipeline using the $linearFill window function operator with an expression-based sortBy expression to cause the mongod process to terminate abnormally. This results in a denia...
Fixed in 8.2.12; 8.0.28; 7.0.39; 8.3.7; 9.1.0-rc0; 9.0.0-rc1
CPU exhaustion via exponential $jsonSchema hashing in MongoDB (CVE-2026-13064)
A flaw in MongoDB's query planning code causes hashing of query solutions involving deeply nested `$jsonSchema` constructs (specifically `InternalSchema*` match expressions) to exhibit exponential time complexity rath...
Fixed in 9.0.0-rc0; 8.2.12; 8.0.28; 8.3.7
Memory exhaustion via QPACK trailer expansion in quic-go HTTP/3 (CVE-2026-40898)
quic-go's HTTP/3 client and server implementations enforce size limits on the QPACK-compressed HEADERS frame but not on the decoded trailer field section, allowing a malicious peer to send a crafted HEADERS frame that...
Fixed in v0.59.1
Authorization bypass via duplicate field in MongoDB $graphLookup (CVE-2026-13060)
An inconsistency between MongoDB's authorization and execution phases of the `$graphLookup` aggregation stage allows an authenticated user with limited read privileges to access documents from collections they are not...
Fixed in 9.0.0-rc0; 8.3.7; 8.2.12; 8.0.28; 7.0.39
CSV injection and reflected XSS in HCL iControl (CVE-2025-52612)
HCL iControl contains a CSV injection vulnerability in its Export CSV functionality, combined with a reflected cross-site scripting (XSS) vulnerability, both caused by insufficient sanitization of input parameters. A ...
Fixed in v4.2.0