Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 6.9 CVE-2026-50560

Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature_CVE-2026-50560

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty H...

netty netty >= 4.2.0.Final, < 4.2.15.Final CVE
MEDIUM 6.1 CVE-2026-50089

Aqara IAM/SSO Gateway open redirect_CVE-2026-50089

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) provides an open redirect, which is an instance of "CWE-601: URL Redirection to Untrusted Site," w...

Aqara Aqara IAM/SSO Gateway 2026-04-20 CVE
MEDIUM 6.5 CVE-2026-50082

Aqara Developer Portal insecure authentication token_CVE-2026-50082

The Aqara Cloud Developer Portal (developer.aqara.com) issued a developer token to any email address supplied by the attacker. This is an instance ...

Aqara Cloud Developer Portal 2026-04-20 CVE
MEDIUM 6.9 CVE-2026-50026

Frappe: Lack of permissions checks in ‘relink’ and ‘set_email_password’ endpoints_CVE-2026-50026

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, a lack of permission checks in these endpoints allowed un...

frappe frappe < 15.107.0 CVE
MEDIUM 5.3 CVE-2026-50020

Netty’s HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted_CVE-2026-50020

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before ...

netty netty >= 4.2.0.Final, < 4.2.15.Final CVE
MEDIUM 4.8 CVE-2026-50009

Netty QUIC stateless reset token material exposed through header-visible connection IDs_CVE-2026-50009

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the sta...

netty netty >= 4.2.0.Final, < 4.2.15.Final CVE
MEDIUM 5.3 CVE-2026-48043

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion_CVE-2026-48043

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and ...

netty netty >= 4.2.0.Final, < 4.2.15.Final CVE
MEDIUM 4.4 CVE-2026-47190

IPAM controller service account granted unnecessary full access to Secrets_CVE-2026-47190

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole gra...

metal3-io ip-address-manager < 1.11.7 CVE
MEDIUM 5.3 CVE-2026-47182

Frappe: Broken Access Control on Private Files_CVE-2026-47182

Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user can access private files by guessing the file pa...

frappe frappe < 16.17.4 CVE
MEDIUM 5.8 CVE-2026-46690

unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race_CVE-2026-46690

unbounded_spsc is an "unbounded" extension of bounded_spsc_queue. In versions 0.2.0 and prior, sender::send pointer-as-value transmute causes OOB r...

spearman unbounded-spsc <= 0.2.0 CVE