Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 397 total.
Host code execution via unvalidated config path annotation in Kata Containers (CVE-2026-50540)
The kata-runtime's `load_config` function accepts an arbitrary `io.katacontainers.config_path` pod annotation and loads the referenced host TOML file without validation or restriction. A pod user who can place a file ...
Fixed in 4.0.0
Missing authentication for critical API functions in LightRAG API server (CVE-2026-61808)
The LightRAG API server binds to all network interfaces (0.0.0.0) with authentication disabled by default. In this default configuration, every administrative and data endpoint is reachable without credentials, as nei...
Fixed in 1.5.5
Heap type confusion in Apache Fory C++ polymorphic deserialization (CVE-2026-71558)
A heap type confusion vulnerability in Apache Fory's C++ deserialization allows a crafted input payload to bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an inc...
Fixed in Apache Fory 1.5.0
Unauthenticated path traversal in SEBLOD Joomla extension (CVE-2026-66914)
An unauthenticated path traversal vulnerability exists in the SEBLOD extension for Joomla. An unauthenticated attacker could exploit this flaw to download arbitrary files from both inside and outside the web root, pot...
Fixed in 3.30.0; 4.7.0; 6.0.1
Authorization bypass enabling arbitrary password reset in TrueBooker plugin for WordPress (CVE-2026-14365)
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress contains a missing authorization flaw that allows unauthenticated attackers to reset the password of any user account, including administr...
Fixed in 1.2.4
Unauthenticated arbitrary password reset in TrueBooker WordPress plugin (CVE-2026-14364)
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress fails to properly validate a user's identity before resetting their password. Unauthenticated attackers can exploit this flaw to reset the...
Fixed in 1.2.4
Insufficient session expiration in Apache Answer (CVE-2026-60053)
Apache Answer fails to invalidate administrative API keys when the owning account is demoted, deactivated, suspended, or deleted. The keys remain fully operational until explicitly removed, allowing unauthorized conti...
Fixed in 2.0.2
SQL injection in Apache Portable Runtime Utility apr_dbd_oracle provider (CVE-2026-34191)
An SQL injection vulnerability exists in the Apache Portable Runtime Utility library via the apr_dbd_oracle provider, caused by improper neutralization of special elements in SQL commands. An attacker capable of influ...
Fixed in fixed in 1.6.x by r1936817
Stack recursion crash in Apache Portable Runtime Utility (APR-util) (CVE-2026-32327)
A flaw in APR-util 1.6.3 and earlier allows a stack recursion attack via the `apr_xml_quote_elem()` function. Any library consumer that parses XML from untrusted sources using this function is exposed to a crash, enab...
Fixed in 1.6.4
Weak PRNG used for Fernet key generation in IBM Langflow OSS (CVE-2026-8470)
IBM Langflow OSS uses Python's non-cryptographic `random` module (Mersenne Twister PRNG) to generate Fernet encryption keys when user secrets are shorter than 32 characters. Because the PRNG is deterministic, identica...
Fixed in 1.11.0
Weak PRNG in cryptographic key derivation in IBM Langflow OSS (CVE-2026-9205)
IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function, classified under CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator). An unauthentica...
Fixed in 1.11.0
Remote out-of-bounds read in Zephyr LwM2M firmware pull URI handling (CVE-2026-10672)
A remote out-of-bounds read exists in Zephyr RTOS's LwM2M firmware pull implementation. A server-controlled Package URI is copied via fixed-length memcpy() into a smaller pull-context buffer without a NUL terminator, ...
Fixed in v4.5.0
CSRF and SSRF in Eclipse GlassFish DownloadServlet leaks admin token (CVE-2026-12605)
Eclipse GlassFish versions 8.0.x before 8.0.4 contain a combined CSRF and SSRF vulnerability in the Admin Console DownloadServlet component. Four ContentSource implementations (LogViewer, LogFiles, LBConfig, ClientStu...
Fixed in 8.0.4
Incorrect access control in VuFind controller permission processing (CVE-2026-52466)
A vulnerability in VuFind's controller-level permission processing allows remote attackers to execute functions blocked by access control. The `\VuFind\Controller\AbstractBase::validateAccessPermission` method fails t...
Fixed in 11.0.4
Sandbox escape to remote code execution in FrontMCP plugin-codecall (CVE-2026-67531)
The `codecall:execute` tool in `@frontmcp/plugin-codecall` exposes live host Zod schema instances to sandboxed scripts through `getTool()`. Because Zod v4 defines `_zod` as a non-configurable, non-writable own propert...
Fixed in 1.5.7
Unauthenticated RPC leading to command execution in Nuxt DevTools (CVE-2026-71319)
Nuxt DevTools exposes a bidirectional RPC channel over the Vite HMR WebSocket with no authentication, token, handshake, or origin check. The `updateOptions()` and `openInEditor()` methods bypass the `ensureDevAuthToke...
Fixed in 3.3.1
OS command injection in Google::Auth for Perl via credentials JSON (CVE-2026-66902)
Google::Auth versions before 0.06 for Perl execute an arbitrary command specified in an external_account credentials JSON file through an ungated `system($command)` call. The Pluggable subclass reads `credential_sourc...
Fixed in 0.06
Command injection in PraisonAI GitHub Actions Claude workflow via PR branch name (CVE-2026-48168)
The bundled Claude GitHub Actions workflow in PraisonAI embeds an attacker-controlled pull request branch name directly into a Bash run block without quoting or validation, enabling shell command injection. Any outsid...
Fixed in >= 4.6.40
Deserialization filter bypass in Jenkins Remoting library (CVE-2026-70426)
In Remoting 3384.v60d89463d9e0 and earlier (except 3355.3357.v931d3c992987), the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation. This allows ...
Fixed in Jenkins 2.576; Jenkins LTS 2.568.2
Missing authorization in Easy Post Submission plugin for WordPress (CVE-2026-4431)
The Easy Post Submission plugin for WordPress contains a missing capability check on the `create_post()` function. The `rbsm_submit_post` AJAX action is registered for unauthenticated users via `wp_ajax_nopriv_rbsm_su...
Fixed in 2.4.0