Security advisories

medium2026-07-02

CVE-2026-52737-Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block

zcashfoundation/zebra · GHSA-gvjc-3w7c-92jx

critical2026-07-02

CVE-2026-52735-zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser

zcashfoundation/zebra · GHSA-gf9r-m956-97qx

high2026-07-02

CVE-2026-52736-Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache

zcashfoundation/zebra · GHSA-4m69-67m6-prqp

low2026-07-02

Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length

zcashfoundation/zebra · GHSA-h72h-ppcx-998p

medium2026-07-02

CVE-2026-52732-zebrad has mempool transaction admission denial via single-peer inbound queue saturation

zcashfoundation/zebra · GHSA-4fc2-h7jh-287c

medium2026-07-02

zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers

zcashfoundation/zebra · GHSA-c8w6-x74f-vmg3

high2026-07-02

Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)

nick-pape/grackle · GHSA-f9ff-5x35-7gfw

low2026-07-02

zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length

zcashfoundation/zebra · GHSA-443g-gwgp-49x4

medium2026-07-02

CVE-2026-52731-zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate

zcashfoundation/zebra · GHSA-qv2r-v3mx-f4pf

high2026-07-02

CVE-2026-4776-Mautic has SQL Injection in API Contact Filtering

mautic/mautic · GHSA-fcmw-wx57-9p75

medium2026-07-02

Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API

froxlor/froxlor · GHSA-q4rm-m6xh-5pv7

medium2026-07-02

Froxlor: Authenticated customers can read other customers' allowed sender aliases

froxlor/froxlor · GHSA-mr9h-45p9-fg8h

high2026-07-02

CVE-2026-49255-electerm has Command Injection in File System Operations (rmrf, mv, cp)

electerm/electerm · GHSA-v5ff-xmfp-p245

low2026-07-02

CVE-2026-49254-Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

dragonflyoss/dragonfly · GHSA-4q9j-6299-gxmr

high2026-07-02

CVE-2026-49253-electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling

electerm/electerm · GHSA-38j7-23hf-9mhc

high2026-07-02

CVE-2026-49250-@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields

edmundhung/conform · GHSA-525m-7f82-2mf7

high2026-07-02

Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)

nick-pape/grackle · GHSA-vv65-f55v-xm6g

high2026-07-02

CVE-2026-49852-joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

authlib/joserfc · GHSA-gg9x-qcx2-xmrh

low2026-07-02

CVE-2026-49245-SFTPGo has stored XSS via inline parameter on public shares and user file download

drakkan/sftpgo · GHSA-3vcg-pv95-pq54

medium2026-07-02

CVE-2026-49244-SFTPGo has path confinement bypass in public browsable share partial ZIP download

drakkan/sftpgo · GHSA-h64p-8h4r-6gfh