Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 263 total.
Authenticated denial of service via $_internalIndexKey in MongoDB (CVE-2026-13055)
An authenticated MongoDB user can crash a mongod server by submitting an aggregation pipeline containing the `$_internalIndexKey` expression with a compound wildcard index specification. The expression fails to handle...
Fixed in 8.2.11; 8.2.12; 8.0.28; 7.0.39; 8.3.7
Denial of service via missing transaction field validation in MongoDB (CVE-2026-13058)
An authenticated user with basic write privileges can send a `startOrContinueTransaction` command without the required `autocommit` field, triggering a fatal internal invariant failure in `initializeOperationSessionIn...
Fixed in 8.2.11; 8.2.12; 8.0.28; 8.3.7; 9.1.0-rc0; 9.0.0-rc1
Heap buffer overflow in List::SomeUtils::XS pairwise function (CVE-2026-12844)
List::SomeUtils::XS before version 0.59 for Perl contains a heap-based buffer overflow in the pairwise() function. The buffer growth logic uses a single quadrupling operation rather than a loop, allowing a block that ...
Fixed in 0.59
Use-after-free in FreeBSD sound(4) driver mmap path (CVE-2026-49417)
The FreeBSD sound(4) driver contains a use-after-free vulnerability in its mmap(2) support. When a mapped audio device is closed, the underlying audio buffer can be freed while the mapping remains valid, allowing the ...
Fixed in 15.1-RC3-p1; 15.0-RELEASE-p10; 14.4-RELEASE-p6; 14.3-RELEASE-p15
Privilege escalation via LD_PRELOAD injection in FreeBSD Linuxulator (CVE-2026-49413)
The FreeBSD Linuxulator incorrectly set AT_SECURE to zero in the ELF auxiliary vector for set-user-ID and set-group-ID Linux binaries because it checked the P_SUGID process flag before that flag is set during execve(2...
Fixed in 15.1-RC3-p1; 15.0-RELEASE-p10; 14.4-RELEASE-p6; 14.3-RELEASE-p15
NULL pointer dereference in JavaScript::Minifier::XS for Perl (CVE-2026-56017)
JavaScript::Minifier::XS before version 0.16 for Perl crashes with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp/division disambiguator in JsTokenizeString walks back o...
Fixed in 0.16
Uncontrolled recursion and O(N²) memory exhaustion in Net::BitTorrent (CVE-2026-57081)
The bencode decoder in Net::BitTorrent recurses once per nested list or dictionary level with no depth cap, and each recursive frame retains its own copy of the remaining buffer, resulting in O(N²) peak memory consump...
Fixed in v2.1.0
Unbounded BPF probe replay loop causes CPU exhaustion in OBI (CVE-2026-45680)
OBI (go.opentelemetry.io/obi) replays BPF probe hits into histogram observations by iterating once per recorded run-count delta during each metrics collection interval. On busy systems, an uncapped delta between scrap...
Fixed in v0.9.0
Unauthorized fork synchronization after visibility change in Gitea (CVE-2026-24451)
The `POST /api/v1/repos/{owner}/{repo}/merge-upstream` endpoint in Gitea fails to enforce visibility restrictions when a parent repository is changed from public to private. A fork owner who no longer has access to th...
Fixed in 1.26.3
Unauthorized access to labels of private organizations in Gitea (CVE-2026-25038)
Gitea 1.26.2 does not properly enforce organization visibility restrictions on the organization label read endpoints. An unauthorized user - one without membership in a private organization - can retrieve that organiz...
Fixed in 1.26.3
Biased DSA nonce/private-key generation in Crypt::DSA for Perl (CVE-2026-14570)
Crypt::DSA versions before 1.22 for Perl derive the DSA signing nonce and private key from a biased random generator (`Crypt::DSA::Util::makerandom`), which forces the high bit of every returned value, making the outp...
Fixed in 1.22
SQL Injection in Kiteworks Secure Data Forms (CVE-2026-24782)
Multiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and so...
Fixed in 9.3.0
Code injection in DBI::Profile via Profile attribute (CVE-2026-14380)
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package, and arguments, and in...
Fixed in 1.650
Incorrect Authorization in PortProtonQt Polkit Rule (CVE-2026-59678)
A custom Polkit rule in PortProtonQt allows arbitrary local users to modify NetworkManager connections and mount/unmount file systems via UDisks2, due to an insecure command-line check that can be bypassed. This can l...
Fixed in 1.3.1
Code Injection in SMA1000 Appliance Management Console (CVE-2026-15410)
A post-authentication code injection vulnerability exists in the SMA1000 Appliance Management Console. Under specific conditions, a remote authenticated attacker with administrator privileges could execute arbitrary O...
Fixed in 12.4.3-03453; 12.5.0-02835
Local Privilege Escalation in Check Point Gaia Portal (CVE-2026-62145)
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges. This local privilege escalation could lead to full compromise...
Fixed in Jumbo Hotfix Accumulator for R82.10 starting from Take 36; Jumbo Hotfix Accumulator for R82 starting from Take 118; Jumbo Hotfix Accumulator for R81.20 starting from Take 158
Deserialization Vulnerability in Telerik UI for AJAX (CVE-2026-13190)
In Progress Telerik UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the PersistenceFramework allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote cod...
Fixed in 2026.2.708
Telerik UI for AJAX PersistenceFramework Cookie Deserialization Vulnerability (CVE-2026-13185)
In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote...
Fixed in 2026.2.708
Path Traversal and Deserialization in Telerik UI for AJAX (CVE-2026-13186)
A path traversal vulnerability in the file-based persistence storage provider of Progress Telerik UI for AJAX allows an attacker to influence which file is loaded as persistence state when the storage key is derived f...
Fixed in 2026.2.708
RadAsyncUpload Padding Oracle Vulnerability in Telerik UI for AJAX (CVE-2026-13182)
In Progress Telerik UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values...
Fixed in 2026.2.708