Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 263 total.
Path traversal in Apache MINA SSHD sshd-git on Windows (CVE-2026-56623)
A path traversal vulnerability in the sshd-git component of Apache MINA SSHD allows an authenticated remote user to access git repositories outside the configured server-side root directory when the server runs on Win...
Fixed in 2.19.0; 3.0.0-M5
Path traversal in Apache MINA SSHD sshd-scp component (CVE-2026-56452)
A path traversal vulnerability in the sshd-scp component of Apache MINA SSHD allows a malicious sender to supply filenames containing path components in SCP "C" or "D" commands. Because received filenames were not val...
Fixed in 2.19.0; 3.0.0-M5
Insecure Direct Object Reference in VSee Clinic File API (CVE-2026-13381)
VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate...
Fixed in VSee Clinic 7.1.26.1; VSee Clinic API 1.3.0.1
Incomplete upload denylist enables authenticated RCE in FreeScout (CVE-2026-53593)
FreeScout's file upload denylist (`Helper::$restricted_extensions`) does not include the `.pht` extension, leaving the authenticated upload endpoint `POST /uploads/upload` (`SecureController@upload`) able to store `.p...
Fixed in 1.8.224
Unauthenticated conversation thread injection in FreeScout (CVE-2026-53591)
FreeScout's email ingestion command skips HMAC verification on the `In-Reply-To` header when the hash component is any length other than 16 characters, due to a backward-compatibility branch in `FetchEmails.php`. An u...
Fixed in 1.8.223
Authenticated remote code execution in Chamilo LMS (CVE-2026-34239)
An insufficient access control vulnerability in Chamilo LMS allows any authenticated user enrolled in a course (student, teacher, or DRH) to reach the `main/inc/ajax/lang.ajax.php` endpoint (`translate_portfolio_categ...
Fixed in 1.11.40
Unauthenticated access to legacy attachments in FreeScout (CVE-2026-48812)
FreeScout's attachment download route contains a logical flaw in its token validation check that unconditionally grants access to any attachment whose `token_type` is set to `TOKEN_TYPE_LEGACY` (value `1`), bypassing ...
Fixed in 1.8.221
Payment validation bypass in Frappe LMS enrollment via unrelated batch (CVE-2026-39385)
Frappe LMS versions 2.51.0 and earlier allow a user to bypass payment validation for paid courses by enrolling through an unrelated batch. This vulnerability enables unauthorized access to paid course content without ...
Fixed in 2.52.0
Unauthenticated API and path traversal in WhatsApp MCP Server (CVE-2026-46555)
The whatsapp-bridge HTTP API in WhatsApp MCP Server listens on 127.0.0.1:8080 without authentication or Host header validation, and the /api/send endpoint accepts an absolute media_path parameter without restricting i...
Fixed in 0.2.1
SQL injection in syslog-ng SQL destination driver (CVE-2026-39879)
A missing sanitization call in `afsql_dd_run_query` allows SQL injection from an untrusted source in syslog-ng's SQL destination driver. This vulnerability is not present in default configurations; the SQL driver must...
Fixed in syslog-ng 4.12; syslog-ng Premium Edition 8.2; syslog-ng Store Box 7.8
Arbitrary recursive deletion via poisoned backup manifest in Network-AI (CVE-2026-58484)
Network-AI's `EnvironmentManager.pruneBackups()` reads backup entries from on-disk `_manifest.json` files and passes the untrusted `path` field directly to `rmSync()` with recursive and force options. An attacker who ...
Fixed in 5.12.2
API impersonation and missing object-level authorization in dataCycle-CORE (CVE-2026-32821)
In dataCycle-CORE, any authenticated API user can supply a `user_email` parameter to the collection API to evaluate permissions as a different user, potentially exposing that user's collections. In V4, the same contro...
Fixed in 26.06.08
Path traversal in dataCycle-CORE markdown renderer (CVE-2026-32820)
The documentation and static markdown renderer in dataCycle-CORE accepts attacker-controlled path segments and processes them only through the Rails HTML sanitizer, which does not strip directory traversal sequences. ...
Fixed in 26.06.08
Open redirect in dataCycle-CORE password reset and confirmation flows (CVE-2026-32824)
A low-privileged authenticated API user can supply attacker-controlled `forwardToUrl` and `redirectUrl` parameters when triggering password reset or account confirmation flows in dataCycle-CORE. These values are embed...
Fixed in 26.06.08
Integer overflow and heap buffer overflow in libvips vipsload operation (CVE-2026-33327)
The `vipsload` operation in libvips could incorrectly determine image dimensions, triggering an integer overflow that leads to a subsequent heap-based buffer overflow. An attacker able to supply a crafted image file m...
Fixed in >=8.18.1
Brute-force protection bypass on login endpoints in dataCycle-CORE (CVE-2026-32825)
dataCycle-CORE versions up to and including 25.07.3 accept unlimited password guesses against both the browser login endpoint (`/users/sign_in`) and the JSON API login endpoint (`/api/v4/auth/login`). Although Devise'...
Fixed in 26.06.08
Heap-based buffer overflow in libvips TIFF image decoding (CVE-2026-35591)
The `tiffload` operation in libvips could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible heap-based buffer overflow. An attacker able to supp...
Fixed in >=8.18.2
Unauthorized text file download via DataLink in dataCycle-CORE (CVE-2026-32807)
dataCycle-CORE contains a public route for downloading DataLink-attached text files that does not enforce link validity, expiry, or caller authentication. Any party in possession of a DataLink UUID - including recipie...
Fixed in 26.06.08
UNC path traversal in Parsec Cloud workspace mountpoint (CVE-2026-25039)
Parsec Cloud does not sanitize workspace names before using them to create mountpoints on the Windows filesystem, allowing a workspace name containing a UNC path (e.g. `\\192.168.1.3\test`) to be evaluated as a networ...
Fixed in 3.3.3-rc.0
Authenticated RCE via malicious eTemplate upload in EGroupware (CVE-2026-40187)
An authenticated administrator can achieve OS-level remote code execution by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method in `api/src/Etemplate/W...
Fixed in 26.4.20260413; 23.1.20260601