Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Authenticated RCE via extension script sandbox escape in alf.io (CVE-2026-35482)
A sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system runs restricted JavaScript ...
Fixed in 2.0-M5-2606
Cross-site scripting in Apache Allura Markdown handling (CVE-2026-73237)
Apache Allura contains a cross-site scripting (XSS) vulnerability in its Markdown processing pipeline. An attacker exploiting this vulnerability could execute malicious scripts in the context of affected users' browsers.
Fixed in 1.19.1
Cross-site scripting in Apache Allura code display (CVE-2026-73238)
Apache Allura contains a cross-site scripting (XSS) vulnerability in its code display functionality. This issue could allow attackers to inject and execute malicious scripts in the context of affected users' browsers.
Fixed in 1.19.1
OS command injection in Semaphore UI git repository handling (CVE-2026-73294)
An OS command injection (CWE-88/CWE-78) vulnerability in Semaphore UI's repository git_url handling allows any user holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore se...
Fixed in 2.18.20
Remote code execution in Prowler via kubeconfig auth-provider cmd-path (CVE-2026-73263)
The Prowler Kubernetes provider connection test accepts kubeconfig credentials that use a legacy `gcp` auth-provider with `config.cmd-path` and `config.cmd-args` fields, because the input validator (`kubeconfig_contai...
Fixed in 5.36.0
JWT authentication bypass via cross-instance token reuse in Yuxi (CVE-2026-50561)
Yuxi's authentication mechanism fails to sufficiently validate the identity token in the Authorization header, performing only a validity check without binding tokens to a specific deployment instance. This allows an ...
Fixed in 0.6.2
Unauthenticated remote code execution in Fabrik Joomla extension (CVE-2026-67282)
An unauthenticated attacker can execute arbitrary code on systems running the Fabrik Joomla extension by exploiting the frontend listfilter model. This vulnerability requires no authentication, allowing any remote att...
Fixed in 4.6.8
Buffer overflow in PROFINET service in Phoenix Contact PLCnext firmware (CVE-2025-41769)
A buffer overflow vulnerability exists in the PROFINET service of Phoenix Contact PLCnext firmware and is present in the default configuration. An unauthenticated remote attacker can exploit this vulnerability to caus...
Fixed in PLCnext firmware version 2026.0.3
Unauthenticated command injection in SonicWall GMS Dispatcher Service (CVE-2026-66147)
An unauthenticated command injection vulnerability exists in the GMS Dispatcher Service in SonicWall GMS 9.5.1 and earlier versions. A remote attacker can exploit this vulnerability through specially crafted requests ...
Fixed in GMS - Virtual Appliance and Windows 9.5.2
Unauthenticated remote code execution via zipslip in SonicWall GMS (CVE-2026-66145)
An unauthenticated remote code execution vulnerability exists in SonicWall GMS 9.5.1 (Build 9510.1044) and earlier versions. A remote attacker can exploit this flaw via zipslip to read sensitive data and perform arbit...
Fixed in GMS - Virtual Appliance and Windows 9.5.2
Cross-workspace OAuth credential takeover in TypeBot (CVE-2026-48765)
TypeBot contains an object-level authorization failure in `handleUpdateOAuthCredentials()` whereby a low-privilege read collaborator can extract an OAuth `credentialsId` from a readable bot configuration and then over...
Fixed in 3.16.2
ActivityPub Update authorization bypass in PeerTube (CVE-2026-73090)
PeerTube's `processUpdateActivity` and `processUpdateVideo` functions accept ActivityPub Update activities containing a Video object without verifying that the signing actor's URL is authorized for the host in the vid...
Fixed in 8.2.2
Unauthenticated SSRF with response read-back in SeaweedFS VolumeServer (CVE-2026-73080)
SeaweedFS VolumeServer exposes an unauthenticated gRPC RPC, FetchAndWriteNeedle, that accepts a caller-supplied remote endpoint and returns the response without validating the target or requiring credentials. An unaut...
Fixed in 4.24
SQL injection in Twenty CRM searchVector field settings (CVE-2026-73069)
Twenty's metadata field update endpoints (REST and GraphQL) accepted an unvalidated `settings.asExpression` value for the system `searchVector` (TS_VECTOR) field, which was concatenated unescaped into a `GENERATED ALW...
Fixed in 2.15.0
Cleartext storage of API tokens in TypeBot (CVE-2026-47702)
TypeBot version 3.16.1 stores API bearer tokens as plaintext strings in the database with no hashing or encryption applied. An attacker who gains read access to the database-through SQL injection, backup exposure, or ...
Fixed in 3.17.0
Missing authentication on IAM gRPC service in SeaweedFS (CVE-2026-72920)
SeaweedFS filer registers the SeaweedIdentityAccessManagement gRPC service without authentication when jwt.filer_signing.key is unset, exposing IAM RPCs (CreateUser, CreateAccessKey, PutPolicy, and related calls) to a...
Fixed in 4.24
Arbitrary binary execution via IPC handler in Streambert (CVE-2026-48056)
The `run-download` IPC handler in Streambert accepts an arbitrary executable path (`binaryPath`) from the renderer process and spawns it via Node's `spawn` without any path validation. A compromised renderer process -...
Fixed in >= 2.5.0
Remote code execution via unvalidated auto-updater IPC handler in Streambert (CVE-2026-48046)
Streambert's `download-and-install-update` IPC handler accepts a user-controlled URL from the renderer process without domain validation. A compromised renderer process - for example via XSS or an untrusted external s...
Fixed in >= 2.5.0
Missing authentication in Node-RED HTTP interface on SIMATIC IoT2050 Advanced (CVE-2026-58115)
SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed do not enforce authentication on the Node-RED HTTP interface, exposing programming nodes capable of executing system commands. An unauthen...
Fixed in V4.3.4.1
Authorization bypass in Craft CMS allowing category structure modification (CVE-2026-72785)
A control-panel user holding only the viewCategories permission for a category group can permanently modify that group's category structure - reordering and re-parenting categories - via the structures/move-element ac...
Fixed in 5.10.6