Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Password reset link poisoning in Kadence Memberships WordPress plugin (CVE-2026-9273)
The Membership Plugin - Kadence Memberships for WordPress contains a password reset link poisoning vulnerability in its legacy lost-password handler, which consumes an attacker-controlled POST parameter into two unval...
Fixed in 4.0.1
Heap buffer overflow in libXfont2 font server client glyph handling (CVE-2026-44950)
A heap buffer overflow exists in fs_read_glyphs() within the libXfont2 font-server client (src/fc/fserve.c). Per-glyph validation confirms each source slice lies within the source bitmap buffer but does not verify tha...
Fixed in libXfont2-2.0.9
Denial of service via session flow control bypass in Apache Qpid Proton Dotnet (CVE-2026-67553)
An authenticated attacker can exceed the session flow control incoming window in Apache Qpid Proton Dotnet, potentially leading to denial of service. The vulnerability exists in all versions through 1.0.0 and requires...
Fixed in 1.1.0
Pre-authentication stack overflow in Apache Qpid Proton Dotnet (CVE-2026-67552)
A pre-authentication attacker can exploit unbounded type nesting in Apache Qpid Proton Dotnet to trigger a StackOverflowError, potentially causing denial of service. No authentication is required to trigger this condi...
Fixed in 1.1.0
Denial of service via unbounded disposition range handling in Apache Qpid Proton-Dotnet (CVE-2026-67554)
An authenticated attacker can craft a disposition frame containing large or illegal ranges, causing excessive CPU usage due to naive range handling in Apache Qpid Proton-Dotnet. Successful exploitation leads to denial...
Fixed in 1.1.0
Resource exhaustion via uncapped transfer frames in Apache Qpid Proton Dotnet (CVE-2026-67555)
Apache Qpid Proton Dotnet did not enforce a maximum number of transfer frames per incoming delivery. An authenticated attacker could exploit this to cause excessive resource usage and a potential denial of service.
Fixed in 1.1.0
Pre-authentication denial of service in Apache Qpid ProtonJ2 (CVE-2026-67589)
A pre-authentication attacker can exploit improper type size/count handling in Apache Qpid ProtonJ2 to trigger excessive memory allocation, leading to potential denial of service. No authentication is required to expl...
Fixed in 1.2.0
Pre-authentication denial of service in Apache Qpid ProtonJ2 (CVE-2026-67588)
Apache Qpid ProtonJ2 contains a vulnerability in its symbol value caching mechanism that imposes no upper bound on cache growth. A pre-authentication attacker can exploit this to exhaust server resources, resulting in...
Fixed in 1.2.0
Pre-authentication stack overflow in Apache Qpid ProtonJ2 (CVE-2026-67590)
A pre-authentication attacker can exploit unbounded type nesting in Apache Qpid ProtonJ2 to trigger a StackOverflowError, potentially causing denial of service. Because the vulnerability is reachable before authentica...
Fixed in 1.2.0
Denial of service via session flow control bypass in Apache Qpid ProtonJ2 (CVE-2026-67591)
An authenticated attacker can exceed the session flow control incoming window in Apache Qpid ProtonJ2, violating protocol-level constraints. This can potentially lead to a denial of service condition on affected systems.
Fixed in 1.2.0
Uncontrolled resource consumption in Apache Qpid ProtonJ2 (CVE-2026-67592)
Apache Qpid ProtonJ2 did not enforce a maximum number of transfer frames per incoming delivery. An authenticated attacker could exploit this to cause excessive resource usage and potential denial of service.
Fixed in 1.2.0
Unauthenticated OAuth2 token refresh endpoint in Flowise (CVE-2026-70478)
The OAuth2 token refresh endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) in Flowise is included in `WHITELIST_URLS`, requiring no authentication. An attacker who obtains a credential ID can call this...
Fixed in 3.1.3
Pre-authentication denial of service in Apache Qpid Proton-J (CVE-2026-66273)
Apache Qpid Proton-J contains a flaw in type size/count handling that allows a pre-authentication attacker to trigger excessive memory allocation. This can lead to a potential denial of service condition.
Fixed in 0.35.0
Pre-authentication resource exhaustion in Apache Qpid Proton-J (CVE-2026-66257)
Apache Qpid Proton-J contains a vulnerability in which symbol values are cached without bound, allowing a pre-authentication attacker to exhaust server resources. Successful exploitation results in denial of service.
Fixed in 0.35.0
Python validator Unicode homoglyph bypass in Flowise (CVE-2026-70470)
The `validatePythonCodeForDataFrame` function in Flowise's `pythonCodeValidator.ts` enforces a JavaScript regex blacklist against dangerous Python identifiers, but JavaScript word-boundary anchors (`\b`) are ASCII-onl...
Fixed in npm flowise 3.1.3; npm flowise-components 3.1.3
Remote code execution in Flowise CSVAgent via unsanitized csvFile interpolation (CVE-2026-69264)
Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template executed by Pyodide without any content validation. Because Pyodide's default js bridg...
Fixed in 3.1.3
Remote code execution in FlowiseAI Flowise via SQLite Record Manager Node (CVE-2026-69259)
The SQLite Record Manager node in Flowise accepts a user-controlled `additionalConfig` input whose contents are spread into the SQLite options object after the `database` property is set, allowing an authenticated att...
Fixed in flowise 3.1.3; flowise-components 3.1.3
Remote code execution via pickle deserialization in Flowise CSVAgent (CVE-2026-69256)
The CSVAgent node in Flowise passes user-supplied input directly into a Python code template executed via pyodide, relying on a denylist to block dangerous constructs. An attacker can bypass this denylist by invoking ...
Fixed in npm flowise 3.1.3; npm flowise-components 3.1.3
Cross-site scripting via URLField values in Django admin (CVE-2026-15920)
The Django admin renders URLField values as clickable links on changelist views and read-only fields without validating the URL as safe. A stored value using a potentially dangerous scheme was rendered as a link, enab...
Fixed in Django 6.0.8; Django 5.2.17
Server-side file-write and request forgery via spatial lookups in Django (CVE-2026-15307)
Django's spatial lookups allowed `str` and `dict` lookup values to be passed to `GDALRaster` when they represented rasters. Depending on the raster driver, this could write a file to disk (in some cases enabling remot...
Fixed in Django 6.0.8; Django 5.2.17