Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 397 total.
Unauthenticated SQL injection in Metacat REST API endpoints (CVE-2026-48528)
Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints. The `nodeId` parameter is appended to backend SQL queries with...
Fixed in >= 3.4.1
OIDC userinfo scope bypass in Gitea (CVE-2026-55982)
The OIDC userinfo endpoint (`GET /login/oauth/userinfo`) in Gitea accepts personal access tokens as bearer credentials without enforcing their assigned scopes. A token scoped only to `read:misc` - which is denied acce...
Fixed in 1.27.0
Publish-boundary bypass via WebSocket broadcast in SiYuan (CVE-2026-72810)
SiYuan's kernel registers WebSocket sessions established through the publish surface into the same broadcast session pool as authenticated sessions, with no role or publish-access filtering applied to outgoing content...
Fixed in v3.7.4
SQL injection in SiYuan backlink/mention search query (CVE-2026-72811)
The backlink/mention search query in SiYuan (kernel/model/backlink.go) concatenates stored block metadata and client-supplied keywords into a SQL MATCH statement, escaping only double quotes and leaving single quotes ...
Fixed in v3.7.4
Home directory collision via case-folded usernames in FileBrowser (CVE-2026-72836)
FileBrowser's self-registration handler compares stored directory scopes with a case-sensitive exact string match, while Windows/NTFS resolves paths case-insensitively. When Signup and CreateUserDir are both enabled a...
Fixed in 2.63.19
Unauthenticated account takeover in Wishlist Member plugin for WordPress (CVE-2026-12949)
The Wishlist Member plugin for WordPress contains an insufficient verification of data authenticity flaw in the wpm_register() function. The function validates the registration cookie only against the GET reg paramete...
Fixed in 3.34.2
Unauthenticated remote code execution in FreePBX UCP Node server (CVE-2026-73665)
FreePBX versions prior to 17.0.9 contain an authentication bypass in the UCP Node server caused by Socket.IO v4 applying middleware only to the default namespace, leaving custom namespaces unauthenticated. An unauthen...
Fixed in 17.0.9
Unicode homoglyph email bypass in NextAuth.js magic-link flow (CVE-2026-73420)
The default email normalizer in NextAuth.js validates an address before applying Unicode normalization, allowing an address containing a homoglyph at-sign character (e.g., U+FF20 FULLWIDTH COMMERCIAL AT) to pass the s...
Fixed in @auth/core 0.41.3
Arbitrary file write via S3 key path traversal in Budibase (CVE-2026-72850)
Budibase's `sanitizeKey` helper preserves `..` segments in S3 object keys because the underlying `sanitize-s3-objectkey@0.0.1` library does not strip them. An authenticated user with builder or admin permissions can u...
Fixed in 3.40.0
Unauthenticated SQL injection in Budibase webhook automations (CVE-2026-72851)
Budibase automation webhook endpoints are unauthenticated by design, allowing any attacker who knows a webhook's (instance, id) pair to POST attacker-controlled JSON that is spliced into EXECUTE_QUERY step bindings an...
Fixed in 3.40.0
SQL injection in FreePBX missedcall module via inbound Caller ID name (CVE-2026-73663)
The FreePBX missedcall module inserts the inbound caller's name directly into a SQL INSERT statement in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated remote attacker can craft a...
Fixed in 16.0.11 (FreePBX 16); 17.0.6 (FreePBX 17)
External file path control enabling remote code execution in IBM Documentation Offline (CVE-2026-17482)
IBM Documentation Offline contains a vulnerability in its embedded Node.js server's template engine whereby external control of a file path (CWE-73) allows a remote, unauthenticated attacker to execute arbitrary code ...
Fixed in 1.5.1
Brute force authentication bypass in IBM Langflow OSS (CVE-2026-19297)
IBM Langflow OSS contains a rate-limiting control on the login endpoint that can be explicitly disabled by an administrator or left unvalidated post-deployment. When disabled, a remote unauthenticated attacker can sub...
Fixed in 1.10.0
Arbitrary file read via AppRole secretIDPath in Vault Secrets Operator (CVE-2026-8715)
Vault Secrets Operator 1.3.0 through 1.4.1 contains a flaw in the AppRole authentication configuration where the `spec.appRole.secretIDPath` field on VaultAuth and VaultAuthGlobal custom resources lacks sufficient pat...
Fixed in Vault Secrets Operator 1.5.0
Cross-project deployment worker registration bypass in Trigger.dev (CVE-2026-73656)
The deployment background-worker registration endpoint in Trigger.dev authenticates requests but looks up the target deployment by friendly ID only, without scoping the lookup to the authenticated environment or proje...
Fixed in >= v4.5.0-rc.3
Authentication bypass in IBM WebSphere Application Server Liberty (CVE-2026-14525)
IBM WebSphere Application Server Liberty contains an authentication bypass vulnerability (CWE-306: Missing Authentication for Critical Function) that is triggered when the rtcomm-1.0 or rtcommGateway-1.0 feature is en...
Fixed in Liberty Fix Pack 26.0.0.9
File-access permission bypass in Vitest Browser Mode provider commands (CVE-2026-73653)
Several Browser Mode provider commands in Vitest accept browser-supplied file paths without enforcing the `allowWrite` permission gate or confining paths to the project root. A client able to reach the Browser Mode AP...
Fixed in 3.2.7; 4.1.10; 5.0.0-beta.6
Predictable SM2 key generation in sm-crypto via weak Node.js RNG (CVE-2026-73567)
The sm-crypto npm package's default `sm2.generateKeyPairHex()` path in Node.js seeds its module-wide SecureRandom instance (from jsbn) using `Math.random()` and `Date.getTime()` instead of a cryptographically secure s...
Fixed in 0.5.3
Git argument injection in Apache Allura (CVE-2026-73240)
Specifically crafted inputs may lead to git argument injection in Apache Allura. A remote attacker able to supply malicious input could exploit this vulnerability to inject arbitrary git arguments, potentially comprom...
Fixed in 1.19.1
Command and argument injection in rsync via unquoted peer- or host-controlled values (CVE-2026-53790)
rsync contains multiple injection vulnerabilities across four code paths - the RSYNC_CONNECT_PROG environment variable host substitution, daemon exec hook expansions, rsync-ssl hostspec handling, and remote-shell newl...
Fixed in 3.5.0