Security advisories

high2026-09-23

CVE-2026-76087-Formie: Unauthenticated users can overwrite incomplete submissions via submit action

View chart →

verbb/formie · GHSA-584p-f93j-wpgc

high2026-09-23

CVE-2026-76086-Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

View chart →

verbb/formie · GHSA-v3f3-cmj4-cvj9

medium2026-09-23

CVE-2026-92692-Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)

View chart →

sulu/sulu · GHSA-jg26-q8hg-3pq4

medium2026-09-23

CVE-2026-77421-JLine: ReDoS in Nano Editor Regex Search Mode

View chart →

jline/jline3 · GHSA-ph9c-7hw9-vhhw

high2026-09-23

CVE-2026-77422-JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

View chart →

jline/jline3 · GHSA-r2xf-8xr9-62gw

high2026-09-23

CVE-2026-56679-9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

View chart →

decolua/9router · GHSA-vmjq-hvgq-2wv4

medium2026-09-23

CVE-2026-56678-9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

View chart →

decolua/9router · GHSA-6mwv-4mrm-5p3m

high2026-09-23

CVE-2026-56676-9router: Image prefetch DNS rebinding allows SSRF to internal services

View chart →

decolua/9router · GHSA-cmhj-wh2f-9cgx

high2026-09-23

CVE-2026-56675-9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

View chart →

decolua/9router · GHSA-x5c9-v98j-722r

medium2026-09-23

CVE-2026-77420-JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

View chart →

jline/jline3 · GHSA-5q95-hrpc-m3w3

critical2026-09-23

CVE-2026-85724-Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

View chart →

moquette-io/moquette · GHSA-5f42-97gr-vfhq

medium2026-09-23

CVE-2026-73858-Solspace Freeform: Limited Twig template injection via submitted field values

View chart →

solspace/craft-freeform · GHSA-gxrg-x694-283w

medium2026-09-23

CVE-2026-88974-WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

View chart →

wp-graphql/wp-graphql · GHSA-5mmc-8pc9-wggg

medium2026-09-23

CVE-2026-63000-REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

View chart →

redaxo/core · GHSA-m8r3-22v6-g877

medium2026-09-23

CVE-2026-63002-REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

View chart →

redaxo/core · GHSA-w998-qmw9-mf4m

medium2026-09-23

CVE-2026-63001-REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

View chart →

redaxo/core · GHSA-mf2p-wjp4-99pq

high2026-09-23

CVE-2026-54892- Plug: quadratic-time decoding of nested query/body parameters enables denial of service

View chart →

elixir-plug/plug · GHSA-j43x-5hjq-rgxf

medium2026-09-23

CVE-2026-61541-Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

View chart →

kap-sh/zapros · GHSA-5vjj-2r48-q622

high2026-09-23

CVE-2026-61652-Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

View chart →

kap-sh/zapros · GHSA-6cp7-3m3c-5x5c

critical2026-09-23

CVE-2026-57149-plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

View chart →

plone/plone.app.portlets · GHSA-rr49-f9g6-c9r5