Open Source Vulnerabilities
Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders
zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders
CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint
CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint
sngrep through 1.9.0 Infinite Loop DoS via Crafted NFLOG TLV
sngrep through 1.9.0 Infinite Loop DoS via Crafted NFLOG TLV
Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packet
Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packet
ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c
ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c
libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex
libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex
Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers
Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers
Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking
Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking
langchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid}
langchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid}
loonflow before r3.2.3 IDOR via ticket_flow_history Endpoint
easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API
dotnet-bootstrap-8, dotnet-bootstrap-8
fastify
TuxCare security update for fastify (2 CVEs)
request-9047-keycloak-fips-26.6-iamguarded-fips
dotnet-bootstrap-9, dotnet-bootstrap-9
Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)
Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)
logstash-9.2-with-output-opensearch
telegraf
CVE-2026-114456 affecting package telegraf 1.31.0-36
influxdb
CVE-2026-114456 affecting package influxdb 2.7.5-23
spark-4.0-scala-2.13, spark-4.0-scala-2.13
