Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 5.3 CVE-2026-50020

Netty’s HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted_CVE-2026-50020

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before ...

netty netty >= 4.2.0.Final, < 4.2.15.Final CVE
MEDIUM 4.8 CVE-2026-50009

Netty QUIC stateless reset token material exposed through header-visible connection IDs_CVE-2026-50009

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the sta...

netty netty >= 4.2.0.Final, < 4.2.15.Final CVE
MEDIUM 5.3 CVE-2026-48043

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion_CVE-2026-48043

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and ...

netty netty >= 4.2.0.Final, < 4.2.15.Final CVE
MEDIUM 4.4 CVE-2026-47190

IPAM controller service account granted unnecessary full access to Secrets_CVE-2026-47190

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole gra...

metal3-io ip-address-manager < 1.11.7 CVE
MEDIUM 5.3 CVE-2026-47182

Frappe: Broken Access Control on Private Files_CVE-2026-47182

Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user can access private files by guessing the file pa...

frappe frappe < 16.17.4 CVE
MEDIUM 5.8 CVE-2026-46690

unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race_CVE-2026-46690

unbounded_spsc is an "unbounded" extension of bounded_spsc_queue. In versions 0.2.0 and prior, sender::send pointer-as-value transmute causes OOB r...

spearman unbounded-spsc <= 0.2.0 CVE
MEDIUM 5.3 CVE-2026-44976

Frappe: IDOR in update_onboarding_step_CVE-2026-44976

Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue...

frappe frappe < 16.17.4 CVE
MEDIUM 5.3 CVE-2026-44975

Frappe: Missing authorization on reset form tours_CVE-2026-44975

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, any authenticated user can reset onboarding for all users...

frappe frappe < 15.107.2 CVE
MEDIUM 5.3 CVE-2026-44967

opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response_CVE-2026-44967

OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full ...

open-telemetry opentelemetry-cpp < 1.27.0 CVE
MEDIUM 6.9 CVE-2026-44208

Frappe: IDOR in `submit_discussion()`_CVE-2026-44208

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, lack of validations in the "submit_discussion()" endpoint...

frappe frappe < 15.107.0 CVE