Security Advisories

medium2026-08-28

CVE-2026-55857-org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

View chart

mariadb-corporation/mariadb-connector-j · GHSA-qxvw-fvwx-5cp7

medium2026-08-28

CVE-2026-55856-MariaDB has cleartext password disclosure to a MITM on the initial-handshake

View chart

mariadb-corporation/mariadb-connector-j · GHSA-g9jj-cgmh-9f38

high2026-08-28

CVE-2026-55843-Snipe-IT has an Improper Privilege Management issue

View chart

grokability/snipe-it · GHSA-j5g3-42wp-gqm3

high2026-08-28

CVE-2026-55848-MapFish Print has XXE that allows reading arbitrary files of certain types

View chart

mapfish/mapfish-print · GHSA-5v29-34h8-v68r

low2026-08-28

CVE-2026-55785-free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

View chart

free5gc/free5gc · GHSA-fp46-6vfw-gc9c

high2026-08-28

CVE-2026-55784-free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

View chart

free5gc/free5gc · GHSA-334q-h5g3-fpxv

medium2026-08-28

CVE-2026-55779-silverstripe/versioned has XSS in archive admin restore

View chart

silverstripe/silverstripe-versioned · GHSA-m4g4-86qc-v8w7

high2026-08-28

CVE-2026-55874-SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

View chart

seaweedfs/seaweedfs · GHSA-56wq-x3wv-3ff4

medium2026-08-28

CVE-2026-55873-SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets

View chart

seaweedfs/seaweedfs · GHSA-hgpf-8634-g44c

medium2026-08-28

CVE-2026-55867-Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

View chart

graylog2/graylog2-server · GHSA-j769-9gv9-65gr

high2026-08-28

CVE-2026-55841-Fortigate syslog message parser can be exploited to modify or delete fields from the original message

View chart

graylog2/graylog2-server · GHSA-gqr6-r77p-c2pj

high2026-08-28

CVE-2026-55764-klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply

View chart

klever-io/klever-go · GHSA-mrpp-v6pg-p54x

medium2026-08-28

CVE-2026-55854-MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

View chart

mariadb-corporation/mariadb-connector-nodejs · GHSA-42r5-vhpq-m858

medium2026-08-28

CVE-2026-55678-arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset

View chart

basekick-labs/arc · GHSA-p378-jp5r-gpgw

high2026-08-28

CVE-2026-55761-Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances

View chart

portainer/portainer · GHSA-x626-fcwx-f5pc

high2026-08-28

CVE-2026-55763-klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits

View chart

klever-io/klever-go · GHSA-v358-wf77-39xv

low2026-08-28

CVE-2026-55891-PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI

View chart

privatebin/privatebin · GHSA-xrjc-c68j-hp7w

medium2026-08-28

CVE-2026-55696-PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

View chart

privatebin/privatebin · GHSA-f2xf-7x3g-4272

medium2026-08-28

AIIR verification and policy gates could report success without enforcing the control (fail-open)

View chart

invariant-systems-ai/aiir · GHSA-73p9-6hrp-8qhr

high2026-08-28

CVE-2026-55484-alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server

View chart

guno1928/alos-http · GHSA-hr6j-w4mw-g9mj