Recent Advisories

Severity ID Title Vendor Product Date Type
LOW 2.1 CVE-2026-34086

AbuseFilter misuses ::userCanBitfield, exposing access-controlled information_CVE-2026-34086

Vulnerability in Wikimedia Foundation AbuseFilter. This issue affects AbuseFilter: from * before 1.43.7, 1.44.4, 1.45.2.

Wikimedia Foundation AbuseFilter * CVE
LOW 2.1 CVE-2026-8233

Dotouch XproUPF access control_CVE-2026-8233

A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipulation c...

Dotouch XproUPF 2.0.0-release-088aa7c4 CVE
LOW 2.9 CVE-2026-45186

CVE-2026-45186_CVE-2026-45186

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted X...

libexpat project libexpat CVE
LOW 2.9 CVE-2026-7262

NULL pointer dereference in SOAP apache:Map decoder with missing _CVE-2026-7262

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured,...

PHP Group PHP 8.2.* CVE
LOW 2.1 CVE-2026-7259

Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()_CVE-2026-7259

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguru...

PHP Group PHP 8.2.* CVE
LOW 2.2 CVE-2026-45182

CVE-2026-45182_CVE-2026-45182

GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayloa...

GrapheneOS GrapheneOS CVE
LOW 2.3 CVE-2026-42245

net-imap: Quadratic complexity when reading response literals_CVE-2026-42245

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::...

ruby net-imap < 0.4.24 CVE
LOW 2.3 CVE-2026-42183

Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)_CVE-2026-42183

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before versi...

argoproj argo-workflows >= 4.0.0, < 4.0.5 CVE
LOW 3.8 CVE-2026-44987

SysReptor: Privilege Escalation from User Admin to Superuser_CVE-2026-44987

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email ad...

Syslifters sysreptor < 2026.29 CVE
LOW 2.3 CVE-2026-44286

FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation_CVE-2026-44286

FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows atta...

labring FastGPT < 4.14.17 CVE