Open Source Vulnerabilities

SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.php

SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorization

SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php

symfony, symfony, symfony

SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM

noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server

LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key

accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql

Posta before v0.18.0 SSRF via Webhook URL

NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens

libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name

buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API

VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length index

eBook-speaker through 6.2.0 Stack-based Buffer Overflow via element name attribute

LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>

WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files

Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadata

org.springframework:spring-beans, org.springframework:spring-context, org.springframework:spring-core, org.springframework:spring-messaging, org.springframework:spring-web, org.springframework:spring-webflux, org.springframework:spring-webmvc

TuxCare security update for org.springframework (10 CVEs)

SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal services

SuiteCRM: Time-Based Blind SQL Injection via REST API

fuse-overlayfs, fuse-overlayfs, fuse-overlayfs, fuse-overlayfs, fuse-overlayfs, fuse-overlayfs, fuse-overlayfs, fuse-overlayfs, fuse-overlayfs, fuse-overlayfs, fuse-overlayfs, fuse-overlayfs, fuse-overlayfs, fuse-overlayfs, fuse-overlayfs

Security update for fuse-overlayfs

SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data Exfiltration

SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api

cpupower, cpupower

Security update for cpupower

SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPage

SuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controller

SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron

org.springframework:spring-expression, org.springframework:spring-web, org.springframework:spring-webflux, org.springframework:spring-webmvc

TuxCare security update for org.springframework (7 CVEs)

filecoin-pin

filecoin-pin: Unbounded DAG pinning can exhaust server resources

org.apache.cxf:cxf-core, org.apache.cxf:cxf-rt-frontend-jaxrs, org.apache.cxf:cxf-rt-wsdl

TuxCare security update for org.apache.cxf (5 CVEs)

org.springframework:spring-beans, org.springframework:spring-expression, org.springframework:spring-web, org.springframework:spring-webflux, org.springframework:spring-webmvc

TuxCare security update for org.springframework (10 CVEs)

prometheus-3.16

prometheus-3.16

prometheus-3.16

prometheus-3.16

prometheus-3.16

prometheus-3.16

golang.org/x/crypto, rootio-golang.org/x/crypto

CVE-2026-56855 in golang.org/x/crypto - Patched by Root

golang.org/x/crypto, rootio-golang.org/x/crypto

CVE-2026-78662 in golang.org/x/crypto - Patched by Root

golang.org/x/crypto, rootio-golang.org/x/crypto

CVE-2026-56854 in golang.org/x/crypto - Patched by Root

org.springframework:spring-beans, org.springframework:spring-core, org.springframework:spring-expression, org.springframework:spring-web, org.springframework:spring-webflux, org.springframework:spring-webmvc, org.springframework:spring-websocket

TuxCare security update for org.springframework (12 CVEs)

banks

Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

github.com/chainguard-dev/kaniko

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass

org.springframework:spring-beans, org.springframework:spring-core, org.springframework:spring-expression, org.springframework:spring-web, org.springframework:spring-webmvc

TuxCare security update for org.springframework (10 CVEs)

github.com/canonical/lxd

lxd allows Cross-guest volume hijack via DevLXD device patch

neo4j-2026.05, neo4j-2026.05

neo4j-2026.05, neo4j-2026.05

neo4j-2026.05, neo4j-2026.05