Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 397 total.
Buffer overflow in PROFINET service in Phoenix Contact PLCnext firmware (CVE-2025-41769)
A buffer overflow vulnerability exists in the PROFINET service of Phoenix Contact PLCnext firmware and is present in the default configuration. An unauthenticated remote attacker can exploit this vulnerability to caus...
Fixed in PLCnext firmware version 2026.0.3
Unauthenticated command injection in SonicWall GMS Dispatcher Service (CVE-2026-66147)
An unauthenticated command injection vulnerability exists in the GMS Dispatcher Service in SonicWall GMS 9.5.1 and earlier versions. A remote attacker can exploit this vulnerability through specially crafted requests ...
Fixed in GMS - Virtual Appliance and Windows 9.5.2
Unauthenticated remote code execution via zipslip in SonicWall GMS (CVE-2026-66145)
An unauthenticated remote code execution vulnerability exists in SonicWall GMS 9.5.1 (Build 9510.1044) and earlier versions. A remote attacker can exploit this flaw via zipslip to read sensitive data and perform arbit...
Fixed in GMS - Virtual Appliance and Windows 9.5.2
Cross-workspace OAuth credential takeover in TypeBot (CVE-2026-48765)
TypeBot contains an object-level authorization failure in `handleUpdateOAuthCredentials()` whereby a low-privilege read collaborator can extract an OAuth `credentialsId` from a readable bot configuration and then over...
Fixed in 3.16.2
ActivityPub Update authorization bypass in PeerTube (CVE-2026-73090)
PeerTube's `processUpdateActivity` and `processUpdateVideo` functions accept ActivityPub Update activities containing a Video object without verifying that the signing actor's URL is authorized for the host in the vid...
Fixed in 8.2.2
Unauthenticated SSRF with response read-back in SeaweedFS VolumeServer (CVE-2026-73080)
SeaweedFS VolumeServer exposes an unauthenticated gRPC RPC, FetchAndWriteNeedle, that accepts a caller-supplied remote endpoint and returns the response without validating the target or requiring credentials. An unaut...
Fixed in 4.24
SQL injection in Twenty CRM searchVector field settings (CVE-2026-73069)
Twenty's metadata field update endpoints (REST and GraphQL) accepted an unvalidated `settings.asExpression` value for the system `searchVector` (TS_VECTOR) field, which was concatenated unescaped into a `GENERATED ALW...
Fixed in 2.15.0
Cleartext storage of API tokens in TypeBot (CVE-2026-47702)
TypeBot version 3.16.1 stores API bearer tokens as plaintext strings in the database with no hashing or encryption applied. An attacker who gains read access to the database-through SQL injection, backup exposure, or ...
Fixed in 3.17.0
Missing authentication on IAM gRPC service in SeaweedFS (CVE-2026-72920)
SeaweedFS filer registers the SeaweedIdentityAccessManagement gRPC service without authentication when jwt.filer_signing.key is unset, exposing IAM RPCs (CreateUser, CreateAccessKey, PutPolicy, and related calls) to a...
Fixed in 4.24
Arbitrary binary execution via IPC handler in Streambert (CVE-2026-48056)
The `run-download` IPC handler in Streambert accepts an arbitrary executable path (`binaryPath`) from the renderer process and spawns it via Node's `spawn` without any path validation. A compromised renderer process -...
Fixed in >= 2.5.0
Remote code execution via unvalidated auto-updater IPC handler in Streambert (CVE-2026-48046)
Streambert's `download-and-install-update` IPC handler accepts a user-controlled URL from the renderer process without domain validation. A compromised renderer process - for example via XSS or an untrusted external s...
Fixed in >= 2.5.0
Missing authentication in Node-RED HTTP interface on SIMATIC IoT2050 Advanced (CVE-2026-58115)
SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed do not enforce authentication on the Node-RED HTTP interface, exposing programming nodes capable of executing system commands. An unauthen...
Fixed in V4.3.4.1
Authorization bypass in Craft CMS allowing category structure modification (CVE-2026-72785)
A control-panel user holding only the viewCategories permission for a category group can permanently modify that group's category structure - reordering and re-parenting categories - via the structures/move-element ac...
Fixed in 5.10.6
Authorization bypass in Commvault CommServe command execution (CVE-2026-13738)
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. The flaw carries a CVSS score of 9.2 (Critical) and could allow unauthorized command execution on affe...
Fixed in 11.46.10 and above; 11.44.11 and above; 11.40.63 and above; 11.36.114 and above
Command restriction bypass in Commvault CommServe (CVE-2026-13737)
CommServe contained an allowlist bypass vulnerability affecting command execution authorization. The flaw is rated Critical (CVSS 9.2) and could allow unauthorized command execution by circumventing authorization cont...
Fixed in 11.46.10 and above; 11.44.11 and above; 11.40.63 and above; 11.36.114 and above
Arbitrary file read via JSON Schema $ref expansion in Firecrawl (CVE-2026-72904)
Firecrawl's extraction functionality unsafely dereferences user-supplied JSON schemas using @apidevtools/json-schema-ref-parser with default resolver settings, allowing local file and remote URL references to be resol...
Fixed in 2.11.32
Remote authentication bypass in HPE AutoPass License Server (CVE-2026-23600)
A remote authentication bypass vulnerability exists in HPE AutoPass License Server (APLS). The vulnerability can be exploited remotely without authentication, posing a risk to the confidentiality, integrity, and avail...
Fixed in HPE AutoPass License Server (APLS) 9.19
OS command injection in Dokploy volume-backup feature (CVE-2026-72901)
An OS command injection vulnerability in Dokploy's volume-backup feature allows any authenticated low-privilege member to execute arbitrary commands on the control-plane host. The `volumeName` field accepted by `volum...
Fixed in v0.29.13
XML External Entity injection in IBM QRadar SIEM (CVE-2026-10025)
IBM QRadar SIEM contains an XXE injection vulnerability in the `parseXmlPayload()` function within the event processing pipeline (`q1labs_core.jar`). When XML-format property autodetection is enabled on at least one l...
Fixed in 7.6.0.2; 7.5.0 UP15 IF05 Hotfix 20260715231428
Broken access control in Dokploy docker-container-terminal WebSocket (CVE-2026-72864)
The local branch of the `/docker-container-terminal` WebSocket endpoint in Dokploy authenticates connections using `validateRequest` but performs no authorization check against the caller's role, organization, or serv...
Fixed in v0.29.13