Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Denial-of-service in Django `check_for_language()` (CVE-2026-15337)
`django.utils.translation.check_for_language()` was vulnerable to a denial-of-service attack when processing many distinct, very long language codes. Each code was stored as a key in an in-memory cache, consuming proc...
Fixed in Django 6.0.8; Django 5.2.17
JavaScript sandbox escape leading to RCE in Flowise (CVE-2026-69253)
An authenticated attacker can escape the vm2 JavaScript sandbox used by Flowise's AgentAsTool, ChatflowTool, and ExecuteFlow nodes by injecting arbitrary code through an unsanitized baseURL parameter, which is interpo...
Fixed in flowise 3.1.3; flowise-components 3.1.3
NodeVM sandbox escape leading to RCE in Flowise (CVE-2026-69254)
A sandbox escape vulnerability in Flowise's `executeJavaScriptCode()` function allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function merges caller-provided `nod...
Fixed in flowise 3.1.3; flowise-components 3.1.3
Remote code execution in FlowiseAI Flowise via TypeORM DataSource (CVE-2026-69251)
Flowise exposes arbitrary TypeORM DataSource options through the `additionalConfig` node input in multiple record manager and agent memory nodes. An authenticated user can abuse options such as `entities`, `subscriber...
Fixed in 3.1.3
Stack-based buffer overflow in Ivanti Connect Secure, Policy Secure, and ZTA Gateways (CVE-2025-22457)
A stack-based buffer overflow vulnerability exists in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti ZTA Gateways. A remote unauthenticated attacker can exploit this vulnerability to achieve remote code execu...
Fixed in Ivanti Connect Secure 22.7R2.6
Authentication bypass in SmarterTools SmarterMail password reset API (CVE-2026-23760)
SmarterMail's AuthenticationService.ForceResetPassword endpoint accepts unauthenticated requests and does not verify an existing password or reset token when resetting system administrator account credentials. An unau...
Fixed in Build 9511
Code injection in Tenable Sensor Proxy (CVE-2026-18667)
A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host. The flaw is classified as code in...
Fixed in Sensor Proxy 1.4.2
Message spoofing and app state corruption in Baileys (CVE-2026-48063)
Baileys sessions can be sent a malicious payload via the placeholderResendMessage mechanism, triggering a fake `messages.upsert` event with a forged message key and payload, enabling arbitrary message spoofing. The sa...
Fixed in 7.0.0-rc12; 6.7.22
SQL injection in Sequelize ORM (Oracle dialect) (CVE-2026-69240)
Sequelize's escape function in sql-string.js fails to escape single quotes in string values that begin with TO_TIMESTAMP or TO_DATE when the Oracle dialect is in use, returning the raw value instead. This allows an un...
Fixed in 6.37.4
Missing authorization on Parameter Context updates in Apache NiFi (CVE-2026-68979)
Apache NiFi fails to enforce authorization checks on components that reference Parameter Context values when those contexts are updated via the REST API. An authenticated user with write access to a Parameter Context ...
Fixed in Apache NiFi 2.11.0
Incorrect authorization for Parameter Context validation in Apache NiFi (CVE-2026-62354)
Apache NiFi incorrectly authorizes Parameter Context validation requests, allowing clients with only read access to submit proposed Parameter values that override current configuration. This enables read-only users to...
Fixed in Apache NiFi 2.11.0
Uncontrolled resource consumption via HTTP decompression in Apache NiFi (CVE-2026-68981)
Apache NiFi enforced its maximum request size limit on the compressed payload of gzip-encoded HTTP requests rather than on the decompressed output. A malicious client can exploit this to send crafted requests that con...
Fixed in Apache NiFi 2.11.0
Authentication bypass in libIEC61850 GOOSE frame parser (CVE-2026-52134)
A flaw in the parseGoosePayload() function in /goose/goose_receiver.c allows an attacker to bypass authentication by replaying or crafting a captured GOOSE frame. Successful exploitation may allow unauthorized control...
Fixed in 1.6.2
Remote code execution via unsanitized eval() in OpenEMR document category tree (CVE-2026-39932)
OpenEMR's Tree class (`library/classes/Tree.class.php`) constructs PHP code strings from database rows and passes them to an unsanitized `eval()` call when loading the document category tree. An authenticated administ...
Fixed in 8.3.0-dev
Path traversal in Apache Jena Fuseki via SPARQL Update requests (CVE-2026-61372)
A path traversal vulnerability in Apache Jena Fuseki allows web requests using SPARQL Update to escape file restrictions. An attacker may leverage this to access files outside of the intended restricted directory. The...
Fixed in 6.2.0
Lambda event spoofing via client-controlled header in @fastify/aws-lambda (CVE-2026-18248)
@fastify/aws-lambda 6.4.0 resolves the request.awsLambda.event and request.awsLambda.context decorations from the client-controllable x-apigateway-event and x-apigateway-context HTTP headers, which are not stripped fr...
Fixed in 6.4.1
Authentication bypass in SiYuan publish-mode password-protected documents (CVE-2026-68584)
SiYuan's publish mode enforces a password check on the primary `getDoc` endpoint via `FilterContentByPublishAccess`, but the endpoints `getHeadingChildrenDOM`, `getHeadingDeleteTransaction`, `getHeadingLevelTransactio...
Fixed in v3.7.3
Publish-access bypass in SiYuan backlink content endpoints (CVE-2026-68586)
SiYuan's backlink API exposes two content endpoints, /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc, that return the rendered DOM of referencing blocks without applying the publish-access filter enforced by th...
Fixed in v3.7.3
Information disclosure in SiYuan via getHeading*Transaction endpoints (CVE-2026-68587)
Three heading transaction endpoints in SiYuan's publish mode (`/api/block/getHeadingDeleteTransaction`, `/api/block/getHeadingLevelTransaction`, and `/api/block/getHeadingInsertTransaction`) return rendered block DOM ...
Fixed in v3.7.3
Arbitrary SQL execution in SiYuan via searchEmbedBlock endpoint (CVE-2026-69084)
The `/api/search/searchEmbedBlock` endpoint in SiYuan passes a client-supplied SQL statement verbatim to the main read-write `siyuan.db` handle with no validation, single-statement guard, read-only restriction, or adm...
Fixed in v3.7.3