Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
TOCTOU privilege escalation in Zoom Clients for Windows (CVE-2026-53410)
CVE-2026-53410 describes a time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows. An authenticated local user could exploit this condit...
Fixed in Zoom Workplace for Windows 7.0.5; Zoom Workplace VDI Client for Windows 6.5.17 and 6.6.14; Zoom Workplace VDI plugin for Windows 6.5.17 and 6.6.14; Zoom Rooms for Windows 7.0.5; Remote Control for Zoom Contact Center for Windows 7.0.0
Improper Privilege Management in Zoom Rooms for Windows (CVE-2026-53409)
CVE-2026-53409 is an Improper Privilege Management vulnerability in Zoom Rooms for Windows. An authenticated user may exploit this vulnerability via local access to conduct an escalation of privilege. The issue carrie...
Fixed in 7.1.0
Hardcoded credentials in Pheditor (CVE-2026-55579)
CVE-2026-55579 is a hardcoded credentials vulnerability (CWE-798) in Pheditor, where the application ships with a default password of "admin" stored as an unsalted SHA-512 hash in the PHP source file with no mechanism...
Fixed in 2.0.6
OS command injection in Pheditor terminal feature (CVE-2026-55578)
CVE-2026-55578 is an OS command injection vulnerability (CWE-78) in the Pheditor terminal feature, where an incomplete character blocklist fails to block the pipe operator (`|`), backtick (`` ` ``), and newline byte (...
Fixed in 2.0.6
Incomplete authorization fix in ArcadeDB schema mutation operations (CVE-2026-54076)
CVE-2026-54076 is an incomplete fix of CVE-2026-44221 in ArcadeDB's engine schema layer, where the prior patch added an UPDATE_SCHEMA authorization check to only one schema-mutating method (LocalDocumentType.createPro...
Fixed in 26.6.1
SSRF and file read in ArcadeDB (CVE-2026-54077)
CVE-2026-54077 is a vulnerability in ArcadeDB's `IMPORT DATABASE` SQL statement that allowed any authenticated user with SQL command access to perform Server-Side Request Forgery (CWE-918) and arbitrary local file rea...
Fixed in 26.6.1
Command whitelist bypass in Pheditor (CVE-2026-54540)
CVE-2026-54540 is an authenticated terminal command whitelist bypass in Pheditor 2.0.4. The terminal feature performs a prefix-based check against the configured TERMINAL_COMMANDS allowlist before passing the full use...
Fixed in 2.0.5
Nil-pointer dereference in CoreDNS proxyproto plugin (CVE-2026-62309)
CVE-2026-62309 is a nil-pointer dereference (CWE-476) in CoreDNS's proxyproto plugin that allows any unauthenticated remote attacker to kill the CoreDNS process with a single 28-byte UDP datagram. A PROXY v2 header ca...
Fixed in 1.14.5
Denial-of-service in CrowdSec's Local API (CVE-2026-44981)
CVE-2026-44981 is a denial-of-service vulnerability in CrowdSec's Local API (LAPI) component, caused by the use of `gin-contrib/gzip` with `DefaultDecompressHandle` globally without enforcing a maximum decompressed si...
Fixed in 1.7.8
Code injection in Nuclio Java runtime build pipeline (CVE-2026-52833)
CVE-2026-52833 is a code injection vulnerability (CWE-94) in Nuclio's Java runtime build pipeline, where unsanitized values from the `runtimeAttributes.repositories` field are rendered verbatim into a Groovy `build.gr...
Fixed in 1.16.5
Admission validation bypass in cert-manager (CVE-2026-62290)
cert-manager (github.com/cert-manager/cert-manager) contains a vulnerability where namespace users can directly create Challenge resources under acme.cert-manager.io without admission validation tying the Challenge to...
Fixed in 1.19.6; 1.20.3
Zip bomb via WebSocket compression in Centrifugo (CVE-2026-62963)
Centrifugo's unidirectional WebSocket transport enforces the configured message size limit against the compressed wire-frame length rather than the decompressed output size. When uni_websocket.compression is enabled, ...
Fixed in 6.8.4
Authentication bypass in Envoy Gateway (CVE-2026-53714)
Envoy Gateway in GatewayNamespaceMode fails to authenticate xDS gRPC unary (Fetch) endpoints due to a missing UnaryInterceptor, and additionally skips JWT validation for State-of-the-World (SotW) DiscoveryRequest mess...
Fixed in 1.7.4; 1.8.1
Path traversal in Whistle HTTP debugging proxy (CVE-2026-55629)
Whistle, an HTTP/HTTP2/HTTPS/WebSocket debugging proxy, contains a path traversal vulnerability in lib/service/service.js. The GET /cgi-bin/temp/get endpoint uses a user-supplied filename parameter directly for file r...
Fixed in 2.10.3
Path traversal in Envoy Gateway via double-slash bypass (CVE-2026-53713)
CVE-2026-53713 is a critical improper input validation vulnerability in Envoy Gateway's `to_absolute_normalized_path` function (security.lua:28-43) that fails to collapse redundant path separators (`//` to `/`). This ...
Fixed in 1.7.4; 1.8.1
Path traversal in zrok's `copy` command (CVE-2026-45576)
CVE-2026-45576 is a path traversal vulnerability in zrok's `copy` command. When copying from a WebDAV or zrok drive source, a malicious share operator can return a crafted DAV `href` (e.g., `/../outside.txt`) that cau...
Fixed in 2.0.3
SSRF in zrok Python SDK ProxyShare (CVE-2026-45568)
A Server-Side Request Forgery (SSRF) vulnerability exists in the zrok Python SDK's ProxyShare component. When a path containing an absolute URL is submitted to the Flask proxy handler, `urllib.parse.urljoin` resolves ...
Fixed in 2.0.3
Argument injection in repomix npm package (CVE-2026-49987)
CVE-2026-49987 is an argument injection vulnerability (CWE-88) in the `repomix` npm package, affecting the `--remote-branch` CLI option. User-supplied input is passed unsanitized to `git fetch` and `git checkout` subp...
Fixed in 1.14.1
Supply chain compromise in cap-js/cds-dbs npm packages (CVE-2026-46421)
CVE-2026-46421 is a supply chain compromise in which malicious versions of `@cap-js/sqlite`, `@cap-js/postgres`, and `@cap-js/db-service` were published on April 29, 2026. The malicious packages harvested credentials ...
Fixed in @cap-js/sqlite >= 2.4.0; @cap-js/postgres >= 2.3.0; @cap-js/db-service >= 2.11.0
Race condition in the `@better-auth/oauth-provider` package (CVE-2026-53518)
CVE-2026-53518 is a race condition vulnerability in the `@better-auth/oauth-provider` package and related `better-auth` plugin paths whereby two concurrent POST requests to the OAuth authorization code token endpoint ...
Fixed in @better-auth/oauth-provider 1.6.11; better-auth 1.6.11