Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Command injection in D-Link DWR-M961 web management interface (CVE-2026-71950)
A command injection vulnerability exists in the `/boafrm/formSmsManage` interface of D-Link DWR-M961 devices with hardware revision C1. A remote attacker can inject arbitrary malicious commands via the `action_value` ...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 web management interface (CVE-2026-71949)
D-Link DWR-M961 devices (hardware revision C1) contain a command injection vulnerability in the /boafrm/formUSSDSetup web management interface. A remote attacker can inject arbitrary commands through the ussdValue and...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 traceroute diagnostic interface (CVE-2026-71947)
A command injection vulnerability exists in the `/boafrm/formTracerouteDiagnosticRun` web-management CGI interface of D-Link DWR-M961 devices (hardware revision C1). A remote attacker can inject arbitrary malicious co...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 web management interface (CVE-2026-71948)
D-Link DWR-M961 devices (hardware revision C1) contain a command injection vulnerability in the `/boafrm/formDebugDiagnosticRun` web management CGI interface. A remote attacker can inject arbitrary malicious commands ...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 web management interface (CVE-2026-71944)
D-Link DWR-M961 devices (hardware revision C1) contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel web management interface. A remote attacker can inject arbitrary commands via the fota_...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 Fibocom FOTA upgrade handler (CVE-2026-71945)
A command injection vulnerability exists in the Fibocom firmware-over-the-air upgrade handler of D-Link DWR-M961 devices (hardware revision C1). A remote attacker can inject arbitrary malicious commands via the `fota_...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 ping diagnostic interface (CVE-2026-71946)
A command injection vulnerability exists in the `/boafrm/formPingDiagnosticRun` web management interface of the D-Link DWR-M961 (hardware revision C1). A remote attacker can inject arbitrary malicious commands via the...
Fixed in 1.1.5_C1_202607071108
Unauthenticated CSRF chain leading to RCE in OpenYak desktop backend (CVE-2026-46409)
The OpenYak desktop backend exposes a local HTTP API on 127.0.0.1 without Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. Any webpage visited while OpenYak is ...
Fixed in 1.1.3
Host code execution via unvalidated config path annotation in Kata Containers (CVE-2026-50540)
The kata-runtime's `load_config` function accepts an arbitrary `io.katacontainers.config_path` pod annotation and loads the referenced host TOML file without validation or restriction. A pod user who can place a file ...
Fixed in 4.0.0
Missing authentication for critical API functions in LightRAG API server (CVE-2026-61808)
The LightRAG API server binds to all network interfaces (0.0.0.0) with authentication disabled by default. In this default configuration, every administrative and data endpoint is reachable without credentials, as nei...
Fixed in 1.5.5
Heap type confusion in Apache Fory C++ polymorphic deserialization (CVE-2026-71558)
A heap type confusion vulnerability in Apache Fory's C++ deserialization allows a crafted input payload to bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an inc...
Fixed in Apache Fory 1.5.0
Unauthenticated path traversal in SEBLOD Joomla extension (CVE-2026-66914)
An unauthenticated path traversal vulnerability exists in the SEBLOD extension for Joomla. An unauthenticated attacker could exploit this flaw to download arbitrary files from both inside and outside the web root, pot...
Fixed in 3.30.0; 4.7.0; 6.0.1
Authorization bypass enabling arbitrary password reset in TrueBooker plugin for WordPress (CVE-2026-14365)
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress contains a missing authorization flaw that allows unauthenticated attackers to reset the password of any user account, including administr...
Fixed in 1.2.4
Unauthenticated arbitrary password reset in TrueBooker WordPress plugin (CVE-2026-14364)
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress fails to properly validate a user's identity before resetting their password. Unauthenticated attackers can exploit this flaw to reset the...
Fixed in 1.2.4
Insufficient session expiration in Apache Answer (CVE-2026-60053)
Apache Answer fails to invalidate administrative API keys when the owning account is demoted, deactivated, suspended, or deleted. The keys remain fully operational until explicitly removed, allowing unauthorized conti...
Fixed in 2.0.2
SQL injection in Apache Portable Runtime Utility apr_dbd_oracle provider (CVE-2026-34191)
An SQL injection vulnerability exists in the Apache Portable Runtime Utility library via the apr_dbd_oracle provider, caused by improper neutralization of special elements in SQL commands. An attacker capable of influ...
Fixed in fixed in 1.6.x by r1936817
Stack recursion crash in Apache Portable Runtime Utility (APR-util) (CVE-2026-32327)
A flaw in APR-util 1.6.3 and earlier allows a stack recursion attack via the `apr_xml_quote_elem()` function. Any library consumer that parses XML from untrusted sources using this function is exposed to a crash, enab...
Fixed in 1.6.4
Weak PRNG used for Fernet key generation in IBM Langflow OSS (CVE-2026-8470)
IBM Langflow OSS uses Python's non-cryptographic `random` module (Mersenne Twister PRNG) to generate Fernet encryption keys when user secrets are shorter than 32 characters. Because the PRNG is deterministic, identica...
Fixed in 1.11.0
Weak PRNG in cryptographic key derivation in IBM Langflow OSS (CVE-2026-9205)
IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function, classified under CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator). An unauthentica...
Fixed in 1.11.0
Remote out-of-bounds read in Zephyr LwM2M firmware pull URI handling (CVE-2026-10672)
A remote out-of-bounds read exists in Zephyr RTOS's LwM2M firmware pull implementation. A server-controlled Package URI is copied via fixed-length memcpy() into a smaller pull-context buffer without a NUL terminator, ...
Fixed in v4.5.0