Recent Advisories

Severity ID Title Vendor Product Date Type
CRITICAL 9.8 CVE-2026-54103

U.S. GAO EPDS and CBCA EDS unauthenticated password change_CVE-2026-54103

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic...

Government Accountability Office Electronic Protest Docketing System (EPDS) CVE
CRITICAL 9.8 CVE-2026-38717

CVE-2026-38717_CVE-2026-38717

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerabili...

n/a n/a n/a CVE
CRITICAL 9.8 CVE-2026-38716

CVE-2026-38716_CVE-2026-38716

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerabili...

n/a n/a n/a CVE
CRITICAL 9.8 CVE-2026-38715

CVE-2026-38715_CVE-2026-38715

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerabili...

n/a n/a n/a CVE
CRITICAL 9.8 CVE-2026-38714

CVE-2026-38714_CVE-2026-38714

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerabili...

n/a n/a n/a CVE
CRITICAL 9.3 CVE-2026-54390

JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer_CVE-2026-54390

JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malic...

JTL Software JTL Shop 5.0.0 CVE
CRITICAL 9.8 CVE-2026-47846

CVE-2026-47846_CVE-2026-47846

Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured vi...

Bitnami bitnami/cassandra 4.0.0 CVE
CRITICAL 9.9 CVE-2026-49252

deepstream is vulnerable to prototype pollution_CVE-2026-49252

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are v...

deepstreamIO deepstream.io < 10.0.5 CVE
CRITICAL 9.1 CVE-2026-49454

Relyra SAML SignatureValue not cryptographically verified -> authentication bypass_CVE-2026-49454

Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Versions 1.0.0 and 1.1.0 accept forged SAML signatures beca...

szTheory relyra >= 1.0.0, < 1.2.0 CVE
CRITICAL 10 CVE-2026-49257

mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind_CVE-2026-49257

mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults ...

startreedata mcp-pinot < 3.1.0 CVE