Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 397 total.
HTTP proxy CONNECT injection in FreeRDP via RDP redirection TargetNetAddress (CVE-2026-67289)
FreeRDP does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and written directly into the HTTP proxy CON...
Fixed in 3.29.0
TLS certificate identity validation bypass in FreeRDP (CVE-2026-66402)
FreeRDP performs custom Common Name and DNS SAN string matching instead of OpenSSL's length-aware identity validation APIs, introducing three distinct weaknesses in server identity verification: DNS SAN values are tru...
Fixed in 3.29.0
Missing authorization to unauthenticated arbitrary file deletion in FormGent plugin for WordPress (CVE-2026-3141)
The FormGent plugin for WordPress fails to enforce capability checks on the `/wp-json/formgent/responses/attachments` REST API endpoint, which is registered without authentication middleware. Unauthenticated attackers...
Fixed in 1.10.0
SSRF and ServiceAccount token exfiltration in vault-secrets-webhook (CVE-2026-54725)
The vault-secrets-webhook uses the `vault.security.banzaicloud.io/vault-addr` annotation value directly as the Vault server address without validation or allowlisting. During admission review, the webhook synchronousl...
Fixed in v1.23.1
Sensitive configuration exposure in Pterodactyl Wings templating engine (CVE-2026-52855)
Pterodactyl Wings exposes its entire daemon configuration to the egg configuration-file templating engine without restricting which paths may be read. A low-privileged user who can set egg variable values may inject `...
Fixed in 1.12.3
Read-only transaction bypass in pgAdmin 4 AI Assistant (CVE-2026-17351)
A sqlparse/PostgreSQL lexer disagreement allows a crafted multi-statement payload to be classified as a single statement by sqlparse while PostgreSQL executes it as multiple statements, smuggling a COMMIT past the BEG...
Fixed in pgAdmin 4 9.17
OS command injection in pgAdmin 4 Import/Export Data tool (CVE-2026-17566)
pgAdmin 4's Import/Export Data tool interpolates a user-supplied SQL query into a psql \copy command line without correctly validating parenthesis boundaries. The parenthesis-balance checker mishandled backslash-escap...
Fixed in pgAdmin 4 9.17
Credential and ownership leakage via adhoc server clone in pgAdmin 4 (CVE-2026-17349)
In pgAdmin 4 9.0 through 9.16, the `/misc/workspace/adhoc_connect_server` endpoint clones an existing server record using `Server.clone()`, which copies all columns verbatim, including ownership fields (`user_id`, `sh...
Fixed in pgAdmin 4 9.17
SQL injection in PHP Jabbers Car Rental Script (CVE-2025-67649)
A SQL injection vulnerability exists in PHP Jabbers Car Rental Script due to improper neutralization of user-supplied input in parameters responsible for sorting functions. An unauthenticated attacker can exploit this...
Fixed in 4.1
Unsafe file upload validation bypass in CodeIgniter4 leading to remote code execution (CVE-2026-63223)
The `is_image` and `mime_in` upload validation rules in CodeIgniter4 do not enforce a safe client filename extension, allowing a remote attacker to upload executable files. Applications that validate uploads with thes...
Fixed in 4.7.4
SQL injection in CodeIgniter4 Query Builder deleteBatch() (CVE-2026-63221)
A SQL injection vulnerability exists in the Query Builder's `deleteBatch()` method in CodeIgniter4. When `deleteBatch()` is used with `where()` conditions, bound values from the WHERE clause are substituted directly i...
Fixed in 4.7.4
Unauthenticated RCE via Socket.IO input handler in LazyOwn (CVE-2026-68502)
LazyOwn's C2 server (lazyc2.py) registers a Socket.IO `input` event handler on the default namespace with no authentication guard. An unauthenticated network attacker who can reach the C2 port can emit an `input` even...
Fixed in release/0.2.158
Remote code execution in IBM Langflow OSS CodeAgent component (CVE-2026-12946)
An authenticated remote attacker can execute arbitrary commands on the server by creating and running a flow that uses the CUGA component's CodeAgent. The vulnerability exists in CodeAgent's Python code execution path...
Fixed in 1.10.1
OS command injection in IBM Power Hardware Management Console (CVE-2026-12943)
IBM Power Hardware Management Console (HMC) contains an OS command injection vulnerability (CWE-78) caused by improper validation of user-supplied input. An unauthenticated remote attacker can exploit this flaw to exe...
Fixed in V10.3.1064.1; V11.1.1112.1
Cross-tenant sandbox cache path traversal in Activepieces Code piece (CVE-2026-48499)
An unsanitized path segment in the Activepieces Code piece sandbox allows an authenticated flow author to access cached flow and code files belonging to other tenants sharing the same worker node. Because the cache is...
Fixed in 0.84.0
Python interpreter sandbox bypass in IBM Langflow OSS (CVE-2026-13435)
IBM Langflow OSS contains an improper input validation vulnerability in its PythonREPL sandbox implementation that allows an attacker with input access to a deployed flow or agent to bypass the code validator. Success...
Fixed in 1.10.2
Directory traversal arbitrary file write in IBM App Connect Enterprise (CVE-2026-15435)
IBM App Connect Enterprise contains a path traversal vulnerability (CWE-22) that allows an unauthenticated remote attacker to write arbitrary files on the system. The attacker exploits this by sending a specially craf...
Fixed in 13.0.8.0; 12.0.12.28
JWT client assertion expiration bypass in Boruta OAuth library (CVE-2026-53431)
Boruta's OAuth 2.0/OIDC token endpoint accepts JWT-based client assertions (client_secret_jwt and private_key_jwt) without enforcing that the exp claim is in the future. The pre-check helper verifies only that an exp ...
Fixed in 2.3.7
Authentication bypass in VMware vCenter Directory Service (CVE-2026-59309)
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized ac...
Fixed in 9.1.0.0300; 9.0.2.0100; 8.0 U3k
Directory traversal in VMware vCenter Syslog server (CVE-2026-59310)
VMware vCenter contains a directory traversal vulnerability in the Syslog server component. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code. Broadcom has rated this vu...
Fixed in 9.1.0.0300; 9.0.2.0100; 8.0 U3k