Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 263 total.
Authenticated path traversal in HPE Aruba Networking EdgeConnect SD-WAN Gateways (CVE-2026-44878)
A path traversal vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways running ECOS allows a highly privileged, authenticated remote attacker to access the device's fi...
Fixed in ECOS 9.4.7.0 and above; ECOS 9.5.7.0 and above; ECOS 9.6.2.0 and above; ECOS 9.7.0.0 and above
Command injection in HPE Aruba Networking EdgeConnect SD-WAN Gateways CLI (CVE-2026-44879)
A command injection vulnerability in the CLI of HPE Aruba Networking EdgeConnect SD-WAN Gateways running ECOS allows a highly privileged, authenticated remote attacker to inject arbitrary commands via certain CLI oper...
Fixed in ECOS 9.4.7.0 and above; ECOS 9.5.7.0 and above; ECOS 9.6.2.0 and above; ECOS 9.7.0.0 and above; ECOS 9.4.5.0 (all builds) and above; ECOS 9.5.5.0 (all builds) and above; ECOS 9.6.0.0 (all builds) and above
Missing authentication for destructive operations in FOGProject fogproject (CVE-2026-47688)
The `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. `clearAES` wipes host AES encryption creden...
Fixed in 1.5.10.1832; 1.6.0-beta.2313
Command injection in MeltanoHub test_dispatcher GitHub Actions workflow (CVE-2026-47690)
The `test_dispatcher` GitHub Actions workflow in MeltanoHub unsafely interpolates attacker-controlled filenames into a shell command, enabling command injection. Because the workflow uses `pull_request_target`, it run...
Fixed in 923820d
Cross-tenant IDOR in Shelf asset tracking platform (CVE-2026-47697)
Shelf, a multi-tenant physical asset tracking platform, failed to verify that entity IDs supplied in requests belonged to the caller's organization. An authenticated user in one organization could read or modify anoth...
Fixed in 1.20.2
Repository visibility manipulation via undocumented git push options in Gitea (CVE-2026-58437)
Gitea's post-receive git hook handler accepts undocumented push options (`repo.private`, `repo.template`) that allow any user with owner or admin-collaborator access to silently toggle a repository's visibility and te...
Fixed in 1.27.0
Account deactivation bypass via OAuth2 sign-in in Gitea (CVE-2026-55987)
Gitea's OAuth2 sign-in callback incorrectly reactivates administrator-deactivated user accounts (`IsActive=false`) when the authentication source does not issue refresh tokens, such as GitHub or any OIDC/OAuth2 source...
Fixed in 1.27.0
SSRF protection bypass via NAT64 prefix in CC-Tweaked (CVE-2026-47695)
CC-Tweaked's HTTP API blocks requests to private network ranges to prevent server-side request forgery (SSRF), but this protection can be bypassed on IPv6-capable servers by addressing internal IPv4 services using NAT...
Fixed in 1.119.0
Improper certificate validation in Gitea internal API HTTP client (CVE-2026-54481)
Gitea's internal API HTTP client hardcodes `InsecureSkipVerify = true` in its TLS configuration with no operator override, making it the only outbound TLS client in the codebase that cannot be configured to verify pee...
Fixed in 1.27.0
Stored XSS via unescaped option label in FOG Project inventory (CVE-2026-47687)
The `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` val...
Fixed in >= 1.5.10.1832; >= 1.6.0-beta.2313
Stored XSS in FOG Project via unauthenticated inventory service endpoint (CVE-2026-47685)
The unauthenticated inventory service endpoint (`/service/inventory.php`) in FOG accepts client-supplied values without sanitization and persists them directly to the database. The Host Management Inventory page subse...
Fixed in >= 1.5.10.1832; >= 1.6.0-beta.2313
Uncontrolled memory allocation and leak in CImg Library `_load_analyze()` (CVE-2026-47667)
In CImg Library prior to version 4.0.0, the `_load_analyze()` function reads a `header_size` field from the first 4 bytes of an Analyze/NIfTI file and passes it directly to a heap allocation without bounding it agains...
Fixed in commit 6a69bf7
Blind SQL injection in Tenable Security Center (CVE-2026-64880)
Tenable Security Center contains a blind SQL injection vulnerability in which unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or paramet...
Fixed in SC202607.1
Branch protection bypass via PR retargeting in Gitea (CVE-2026-58439)
Gitea does not re-evaluate the `official` flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access can obtain an `official: true` approval against an unprotected branch...
Fixed in 1.27.0
SSRF and repository exfiltration via HTTP redirect bypass in Gitea (CVE-2026-57894)
Gitea validates the user-supplied URL before repository migration but passes the original URL to the Git command-line client, which follows HTTP redirects by default. A low-privileged authenticated user can supply a p...
Fixed in 1.27.0
Reflected XSS in DHIS2 OpenAPI HTML scope parameter (CVE-2026-55081)
The DHIS2 OpenAPI HTML endpoint reflects values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value can be rendered as active HTML or JavaScript i...
Fixed in 2.42.5.1; 2.43.0.1; 2.44 development branch after PR #24162
SQL injection in DHIS2 SqlView filter parameter (CVE-2026-55084)
A SQL injection vulnerability exists in the `filter` parameter of the DHIS2 `/api/sqlViews/{viewId}/data.json` API endpoint. An authenticated user with access to any SqlView can inject arbitrary SQL queries, with erro...
Fixed in 2.37-EOS (2026-06-09); 2.38-EOS (2026-06-09); 2.39-EOS (2026-06-09); 2.40.11.1; 2.40.12; 2.41.8.2; 2.42.5.1; 2.43.0.1; 2.44 development branch after PR #24162
Denial of service via malformed Host header in websocket-driver-ruby (CVE-2026-61666)
The websocket-driver-ruby library fails to catch `URI::InvalidURIError` exceptions raised when parsing a malformed `Host` header in WebSocket server mode. A remote client can exploit this by sending an invalid `Host` ...
Fixed in >= 0.8.2
Missing authorization in HumHub Space member management (CVE-2026-47657)
A missing authorization check in HumHub's Space member management controller allows any authenticated user to trigger the removal of all members from any Space, without regard to the user's own role or membership in t...
Fixed in 1.18.3
Arbitrary file write in PraisonAI Python API (CVE-2026-47397)
PraisonAI's `write_file` tool skips path validation when `workspace=None`, which is always the case in production. An attacker can host a webpage containing hidden metadata that instructs the agent to write attacker-c...
Fixed in >= 4.6.40