Verified Advisories

Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 143 total.

Severity: All Critical High

Library: langflow_oss 18 openclaw 10 SurrealDB 10 grav 7 avi_load_balancer 6 surrealdb 4 pheditor/pheditor 3 mpp 3 getkirby/cms 3 Wazuh 3 wordpress 2 Quicly 2 meta-ads-mcp 2 jupyter-enterprise-gateway 2 fastify_http_proxy 2 github.com/envoyproxy/gateway 2 com.arcadedb:arcadedb-engine 2 engineering_ai_hub 2 YAML::Syck 1 Fast Uri 1

CVE-2026-46421 CRITICAL CVSS 9.3 Verified Advisory Jul 15, 2026

Supply chain compromise in cap-js/cds-dbs npm packages (CVE-2026-46421)

CVE-2026-46421 is a supply chain compromise in which malicious versions of `@cap-js/sqlite`, `@cap-js/postgres`, and `@cap-js/db-service` were published on April 29, 2026. The malicious packages harvested credentials ...

Fixed in @cap-js/sqlite >= 2.4.0; @cap-js/postgres >= 2.3.0; @cap-js/db-service >= 2.11.0

Information Disclosure Node.js PostgreSQL

CVE-2026-53518 HIGH CVSS 7.6 Verified Advisory Jul 15, 2026

Race condition in the `@better-auth/oauth-provider` package (CVE-2026-53518)

CVE-2026-53518 is a race condition vulnerability in the `@better-auth/oauth-provider` package and related `better-auth` plugin paths whereby two concurrent POST requests to the OAuth authorization code token endpoint ...

Fixed in @better-auth/oauth-provider 1.6.11; better-auth 1.6.11

Authentication Bypass Nginx Microsoft Redis

CVE-2026-15409 CRITICAL CVSS 10.0 Verified Advisory Jul 15, 2026

Server-Side Request Forgery in SonicWall SMA1000 Appliance Work Place (CVE-2026-15409)

CVE-2026-15409 is a Server-Side Request Forgery (SSRF) vulnerability in the SonicWall SMA1000 Appliance Work Place interface (CWE-918). A remote unauthenticated attacker could exploit this vulnerability to cause the a...

Fixed in 12.4.3-03453 (platform-hotfix) and higher versions; 12.5.0-02835 (platform-hotfix) and higher versions

SSRF Sma1000

Prev Page 8 of 8