CVE Recipes

High-severity Ollama GGUF loader out-of-bounds read. Upgrade Ollama to 0.17.1+, restrict model creation and push endpoints, and rotate secrets if the service was exposed.

Critical Microsoft 365 Copilot AI command-injection issue. For Microsoft tenants, verify service-side remediation and data-governance controls; for owned copilots and connectors, patch prompt provenance, external fetch, and egress boundaries.

Critical Comet Backup tenant-impersonation IDOR. Upgrade affected Comet servers, contain tenant-admin impersonation paths, rotate sessions/API tokens, and audit cross-tenant access.

Bash function-export parser RCE — and the five sibling CVEs that came with it. Upgrade Bash through every patch level; audit CGI / DHCP / SSH-hook surfaces.

High null pointer denial of service in Envoy. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High denial of service in Envoy. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High remediation recipe for cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configura. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

High remediation recipe for During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates t. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

High remediation recipe for A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certi. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

High remediation recipe for A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allow. Upgrade to version 2.5.0 through 2.5.11 and remove the vulnerable dos pattern.

High remediation recipe for The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

High remediation recipe for UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC_Ms. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable crypto pattern.

High remediation recipe for Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STAT. Upgrade to patched to the handler and and remove the vulnerable command-injection pattern.

High remediation recipe for FFmpeg RASC DLTA decoder out-of-bounds heap write. Apply vendor-patched FFmpeg build; disable RASC decoding until fixed packages land and remove the vulnerable memory-safety pattern.

High remediation recipe for libssh2 publickey attribute count integer overflow. Apply upstream commit/release after 1.11.1 that bounds attribute allocation; disable publickey listing against untrusted servers until patched and remove the vulnerable memory-safety pattern.

High remediation recipe for wolfSSL's AVX2-optimized ML-KEM implementation (mlkem_cmp_avx2) compares only 1536 of the 1568 ciphertext byte. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable crypto pattern.

High remediation recipe for The X25519 x86_64 assembly implementation fails to clear the most significant bit during the final modular red. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable crypto pattern.

High remediation recipe for X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

High remediation recipe for wolfSSL SNI/ALPN session resumption binding bypass. Apply wolfSSL 5.9.2 or PR 10489 and remove the vulnerable tls-auth pattern.

High remediation recipe for X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X5. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

High remediation recipe for NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of. Upgrade to version 4.13.0 has a heap use-after-free bug in logging errors on TL and remove the vulnerable dos pattern.

High remediation recipe for Out-of-bounds heap read during SM2/SM3 certificate signature verification. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

High remediation recipe for When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client ce. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

High remediation recipe for In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_par. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable crypto pattern.

High remediation recipe for In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. Upgrade to fixed message bag and remove the vulnerable cert-validation pattern.

High remediation recipe for wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid duri. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable crypto pattern.

High remediation recipe for wolfSSL DTLS 1.3 ACK serialization heap overflow. Apply wolfSSL 5.9.1 or later and remove the vulnerable memory-safety pattern.

High remediation recipe for wolfSSL X.509 name-constraints common-name bypass. Apply wolfSSL 5.9.2 or later, or vendor patch for name-constraint CN handling and remove the vulnerable cert-validation pattern.

Critical remediation recipe for Use-after-free in PQC hybrid key-share handling. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable crypto pattern.

High remediation recipe for iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, pr. Upgrade to version 5.9.0. and remove the vulnerable authz pattern.

Critical remediation recipe for Traefik is an HTTP reverse proxy and load balancer. Upgrade to fixed in 3.7.3. and remove the vulnerable command-injection pattern.

High remediation recipe for Caddy is an extensible server platform that uses TLS by default. Upgrade to fixed in 2.11.4. and remove the vulnerable authz pattern.

Critical remediation recipe for Traefik is an HTTP reverse proxy and load balancer. Upgrade to fixed in 3.7.3. and remove the vulnerable command-injection pattern.

High remediation recipe for Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (sock. Upgrade to Upgrade to undici v7.28.0 or v8.5.0. and remove the vulnerable cert-validation pattern.

High remediation recipe for Netty is a network application framework for development of protocol servers and clients. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable prototype-pollution pattern.

High remediation recipe for Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable crypto pattern.

High remediation recipe for In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl process. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for In the Linux kernel, the following vulnerability has been resolved: MIPS: Work around LLVM bug when gp is used. Upgrade to Apply the Ubuntu package versions named in the linked USN notice or the upstream fixed release and remove the vulnerable authz pattern.

High remediation recipe for A flaw was found in the OpenShift Router. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

High remediation recipe for Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) al. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

High remediation recipe for A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially craft. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could ca. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

High remediation recipe for A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

High remediation recipe for Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Upgrade to patched in versions 0.3.10 and remove the vulnerable authz pattern.

High remediation recipe for A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfull. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable auth-bypass pattern.

High remediation recipe for A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly igno. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

High remediation recipe for A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leadi. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

High remediation recipe for TLS protocol dissector heap overflow in Wireshark 4.6.0 to 4.6.4 allows denial of service and possible code ex. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

Critical remediation recipe for Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel C. Upgrade to fixed with Camel and remove the vulnerable command-injection pattern.

Critical remediation recipe for In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY erro. Upgrade to Apply the Ubuntu package versions named in the linked USN notice or the upstream fixed release and remove the vulnerable use-after-free pattern.

High remediation recipe for Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache Ac. Upgrade to fixed as well. and remove the vulnerable dos pattern.

High remediation recipe for A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a spe. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

High remediation recipe for During chain building, the amount of work that is done is not correctly limited when a large number of interme. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

High remediation recipe for If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the co. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP design. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

Critical remediation recipe for Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationDa. Upgrade to version 3.11.1 and remove the vulnerable command-injection pattern.

High remediation recipe for Traefik is an HTTP reverse proxy and load balancer. Upgrade to patched in versions 2.11.38 and 3.6.9. and remove the vulnerable authz pattern.

High remediation recipe for Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configu. Upgrade to fixed in version 0.50.1. To workaround this issue and remove the vulnerable cert-validation pattern.

High remediation recipe for Traefik is an HTTP reverse proxy and load balancer. Upgrade to fixed in 3.6.8. and remove the vulnerable dos pattern.

Critical remediation recipe for A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transpo. Upgrade to version 7.12.0 and remove the vulnerable command-injection pattern.

High remediation recipe for Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

High remediation recipe for Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based applicati. Upgrade to fixed in 1.5.7 and 1.6.2. and remove the vulnerable command-injection pattern.

High remediation recipe for A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

High remediation recipe for A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloadi. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

High out-of-bounds write in A flaw was found. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High-severity FFmpeg RASC decoder DLTA row out-of-bounds write. A crafted media file can corrupt memory in services that transcode or inspect user-supplied video.

High out-of-bounds read in FFmpeg s RASC video. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High heap buffer overflow in libssh2. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High-severity libssh2 publickey attribute count integer overflow. A malicious SSH server can corrupt memory in clients, deployment agents, or embedded devices that connect outbound.

High-severity wolfSSL TLS resumption SNI ALPN binding bypass. Cached client-authentication state can cross virtual-host boundaries and bypass stricter authentication policy.

High out-of-bounds read in RTKLIB. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High MAC verification bypass in HMAC zero-length tag forgery. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High heap buffer overflow in the DTLS 1.3 ACK serialization path. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High-severity wolfSSL DTLS 1.3 ACK serialization heap overflow. Unauthenticated DTLS traffic can crash or corrupt memory in edge, IoT, and embedded services before peer authentication.

High-severity wolfSSL X.509 commonName name-constraint bypass. A constrained CA can issue a certificate whose commonName escapes intended DNS constraints and is still accepted by clients.

High certificate constraint bypass in iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High MAC verification bypass in wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

Critical out-of-bounds write in libssh2. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

Critical authentication bypass in gnutls. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

Critical out-of-bounds read in A flaw in GnuTLS. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High security control bypass in gnutls. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High privilege escalation in libcap. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High-severity FreeRDP server-side cliprdr heap overflow. Upgrade FreeRDP to 3.26.0+, disable clipboard redirection where exposed, and add non-exploit RDP server configuration checks.

Critical security control bypass in Gitea act_runner with the. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High-severity BOSH Director command injection during release upload and unpack. Upgrade BOSH Director to v282.1.12+, restrict release-upload scope, and audit release upload activity.

Critical Nx Console VS Code extension supply-chain compromise. Remove version 18.95.0, upgrade to 18.100.0+, add extension-version guards, and document developer-machine credential rotation.

High remediation recipe for Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body be. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custo. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High-severity MessagePack-CSharp LZ4 decompression out-of-bounds read and process crash. Upgrade MessagePack to 2.5.301+ or 3.1.7+, disable LZ4 on untrusted inputs if blocked, and isolate deserialization paths.

High-severity DoS in System.Security.Cryptography.Xml with patched releases in .NET 8/9/10 trains.

High-severity Bandit denial of service via uncapped WebSocket permessage-deflate inflation. Upgrade Hex package bandit to 1.11.0+ or disable compressed WebSocket upgrades until patched.

High-severity Bandit WebSocket denial of service via unbounded fragmented message reassembly. Upgrade Hex package bandit to 1.11.0+ and verify exposed Phoenix/WebSock endpoints.

High stack buffer overflow in Tenda JD12L 16. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High stack buffer overflow in Tenda JD12L 16. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High stack buffer overflow in Tenda JD12L 16. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High stack buffer overflow in Tenda JD12L 16. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High stack buffer overflow in Wavlink WL-NU516U1-A M16U1_V240425. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High command injection in D-Link DCS-935L 1. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High buffer overflow in Edimax EW-7478APC 1. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High stack buffer overflow in Edimax EW-7478APC 1. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High stack buffer overflow in Edimax EW-7478APC 1. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

Critical security control bypass in The WSO2 API Manager. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High improper access control in JetBrains YouTrack. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High security control bypass in JetBrains YouTrack. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

Critical prototype pollution in JetBrains YouTrack. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High privilege escalation in Bitwarden Server before 2026.5.0. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High security control bypass in polkit authentication of qSnapper. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High path traversal in qSnapper. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High security control bypass in qSnapper. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High security control bypass in Incorrect caching of authentication. Upgrade or patch the affected code path, add regression coverage, and deploy with detection for exploitation attempts.

High remediation recipe for HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Techno. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable path-traversal pattern.

High remediation recipe for The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable sql-injection pattern.

Critical remediation recipe for A flaw was found in the file_type content detector of guardrails-detectors. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for A flaw was found in the guardrails-detectors component. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for The charging station websocket endpoint accepts connections without proper authentication, which could lead to. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrar. Upgrade to SMR Jul-2026 Release in Android 14, 15, 16 and remove the vulnerable memory-corruption pattern.

High remediation recipe for Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 all. Upgrade to SMR Jul-2026 Release in Android 14, 15, 16 and remove the vulnerable memory-corruption pattern.

High remediation recipe for Time-of-check time-of-use race condition in fabricKeymaster trustlet prior to SMR Jul-2026 Release 1 allows lo. Upgrade to SMR Jul-2026 Release in Android 14, 15, 16 and remove the vulnerable authz pattern.

High remediation recipe for Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allo. Upgrade to SMR Jul-2026 Release in Android 14, 15, 16 and remove the vulnerable memory-corruption pattern.

High remediation recipe for Out-of-bounds write in libpadm.so library prior to SMR Jul-2026 Release 1 allows local attackers to execute ar. Upgrade to SMR Jul-2026 Release in Android 14, 15, 16 and remove the vulnerable memory-corruption pattern.

High remediation recipe for Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to. Upgrade to 4.0.70.8 and remove the vulnerable authz pattern.

High remediation recipe for FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows aut. Upgrade to fixed in commit acc88cf and remove the vulnerable authz pattern.

High remediation recipe for FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated. Upgrade to https://github.com/flaskbb/flaskbb/commit/a5da9a52 and remove the vulnerable authz pattern.

Critical remediation recipe for Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Ret. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable sql-injection pattern.

High remediation recipe for Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable auth-bypass pattern.

High remediation recipe for Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. Upgrade to 4.5.2.2 and remove the vulnerable authz pattern.

High remediation recipe for The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. Upgrade to 4.5.2.2 and remove the vulnerable authz pattern.

High remediation recipe for adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompresse. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

Critical remediation recipe for Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable path-traversal pattern.

High remediation recipe for Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for Frappe is a full-stack web application framework. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable credential-leak pattern.

Critical remediation recipe for R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Previously, there was no throttling on repeated authentication attempts to the charging station backend, which. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Multiple connections to the backend using the same charging station ID are allowed, which could allow an attac. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/src/ssrf/v. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable ssrf pattern.

High remediation recipe for Frappe is a full-stack web application framework. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/Create. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Coturn is a free open source implementation of TURN and STUN Server. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Coturn is a free open source implementation of TURN and STUN Server. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to e. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Lima launches Linux virtual machines, typically on macOS, for running containerd. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management i. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untrusted Data vul. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable deserialization pattern.

High remediation recipe for Spinnaker is an open source, multi-cloud continuous delivery platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for OpenResty is a high performance web platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Snipe-IT is an IT asset/license management system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Snipe-IT is an IT asset/license management system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full databa. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable credential-leak pattern.

High remediation recipe for 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/login. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Snipe-IT is an IT asset/license management system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy request is l. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for ZITADEL is an open source identity management platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for FreeRDP is a free implementation of the Remote Desktop Protocol. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Snipe-IT is an IT asset/license management system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Frappe is a full-stack web application framework. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for OpenReplay is a self-hosted session replay suite. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for OpenReplay is a self-hosted session replay suite. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for OpenReplay is a self-hosted session replay suite. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Tilt defines dev environments as code for microservice apps on Kubernetes. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Tilt defines dev environments as code for microservice apps on Kubernetes. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability. Upgrade to Apply mitigations or fixed release per vendor/CISA KEV instructions and remove the vulnerable unsafe-upload pattern.

High remediation recipe for ZITADEL is an open source identity management platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host befo. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements us. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements us. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable sql-injection pattern.

High remediation recipe for Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements us. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable sql-injection pattern.

Critical remediation recipe for Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashe. Upgrade to 2.2.1 and remove the vulnerable authz pattern.

High remediation recipe for FreeRDP is a free implementation of the Remote Desktop Protocol. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for RabbitMQ is a messaging and streaming broker. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for RabbitMQ is a messaging and streaming broker. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for RabbitMQ is a messaging and streaming broker. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for RabbitMQ is a messaging and streaming broker. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for RabbitMQ is a messaging and streaming broker. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Misskey is an open source, federated social media platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

Critical remediation recipe for Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable auth-bypass pattern.

High remediation recipe for RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer g. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

Critical remediation recipe for Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek I. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable sql-injection pattern.

Critical remediation recipe for grav-plugin-database is the database plugin for Grav CMS. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the POST /api. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable path-traversal pattern.

Critical remediation recipe for Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email do. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID h. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable path-traversal pattern.

High remediation recipe for In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported dat. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable xss pattern.

High remediation recipe for In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable xss pattern.

High remediation recipe for PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that all. Upgrade to 4.6.78 and remove the vulnerable command-injection pattern.

High remediation recipe for PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of issue dependencies. Upgrade to 0.1.9 and remove the vulnerable authz pattern.

High remediation recipe for Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on u. Upgrade to 2.0.1 and remove the vulnerable authz pattern.

Critical remediation recipe for MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_g. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonC. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable sql-injection pattern.

High remediation recipe for Authorization bypass through User-Controlled key vulnerability in Teracity Software Technologies Inc. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corresp. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corresp. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corresp. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictio. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the noti. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) fo. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certif. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable cert-validation pattern.

Critical remediation recipe for A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reins. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable auth-bypass pattern.

High remediation recipe for A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated untermi. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicS. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable xss pattern.

Critical remediation recipe for When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts are leaked. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corresp. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corresp. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corresp. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corresp. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to ca. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable path-traversal pattern.

High remediation recipe for A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation wh. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

Critical remediation recipe for [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corresp. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP T. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Discourse is an open-source discussion platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary file. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Kirby is an open-source content management system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Langroid is a framework for building large-language-model-powered applications. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Langroid is a framework for building large-language-model-powered applications. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for SOPlanning is vulnerable to SQL injection in the audit retention configuration. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable sql-injection pattern.

Critical remediation recipe for MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (includi. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allow. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes th. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c allowing a re. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Discourse is an open-source discussion platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable xss pattern.

High remediation recipe for Kirby is an open-source content management system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

Critical remediation recipe for Kirby is an open-source content management system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Kirby is an open-source content management system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

Critical remediation recipe for Langroid is a framework for building large-language-model-powered applications. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Langroid is a framework for building large-language-model-powered applications. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Pimcore is an Open Source Data & Experience Management Platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Discourse is an open-source discussion platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for DeepSeek MCP Server is an MCP server for DeepSeek V4. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable mcp-auth pattern.

Critical remediation recipe for Langroid is a framework for building large-language-model-powered applications. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable sql-injection pattern.

High remediation recipe for An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Network. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

High remediation recipe for An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Juniper Networks J. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filt. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

Critical remediation recipe for Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remot. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable auth-bypass pattern.

Critical remediation recipe for Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remot. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable credential-leak pattern.

High remediation recipe for Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof th. Upgrade to fixed at commit 4c06658 and remove the vulnerable command-injection pattern.

High remediation recipe for Mockoon provides way to design and run mock APIs. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for n8n is an open source workflow automation platform. Upgrade to fixed in versions 1.123.61 and remove the vulnerable command-injection pattern.

High remediation recipe for n8n is an open source workflow automation platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for n8n is an open source workflow automation platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for n8n is an open source workflow automation platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove S. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable sql-injection pattern.

High remediation recipe for A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for Hoppscotch is an open source API development ecosystem. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Hoppscotch is an open source API development ecosystem. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for SiYuan is an open-source personal knowledge management system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Vim is an open source, command line text editor. Upgrade to fixed in version 9.2.0735. and remove the vulnerable command-injection pattern.

High remediation recipe for Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows un. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that all. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

High remediation recipe for LibreBooking's email template editor save action passes the submitted template name directly into the destinat. Upgrade to 5.1.0 and remove the vulnerable credential-leak pattern.

High remediation recipe for OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable request-smuggling pattern.

High remediation recipe for Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Net. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate u. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in IndexedDB in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbi. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for Use after free in Extensions in Google Chrome prior to 150.0.7871.115 allowed an attacker who convinced a user. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a use. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for Use after free in Ozone in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially expl. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

Critical remediation recipe for Use after free in Autofill in Google Chrome on Android prior to 150.0.7871.115 allowed a remote attacker to po. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to p. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in Actor in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrar. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrar. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised th. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had c. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitra. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871.115 allow. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Inappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to pote. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to ex. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrar. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially expl. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrar. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in InterestGroups in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for DBS Etherwatch file parser crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

High remediation recipe for U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

High remediation recipe for U-Boot through 2026.04-rc3 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c). Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable path-traversal pattern.

High remediation recipe for Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node before v1.36.0 allows unauthen. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unaut. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable credential-leak pattern.

High remediation recipe for OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authentic. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

Critical remediation recipe for . Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its networ. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

Critical remediation recipe for An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10,. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for Copier is a library and CLI app for rendering project templates. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for JupyterLab Git is a Git extension for JupyterLab. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for yt-dlp and youtube-dl are command-line audio/video downloaders. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and x. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_recei. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-ser. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/t. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for The user-controllable executable files will be directly executed by high-privilege processes, allowing low-pri. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver proto. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a securit. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Astro is a web framework for content-driven websites. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.De. Upgrade to fixed in commit 047aec1 and remove the vulnerable authz pattern.

High remediation recipe for Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS mis. Upgrade to 86f4118d1d847041c63d79e347e08c87c3f1a882 and remove the vulnerable authz pattern.

High remediation recipe for Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that all. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attac. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable ssrf pattern.

High remediation recipe for Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to r. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Immutable.js provides many Persistent Immutable data structures. Upgrade to fixed in versions 4.3.9 and 5.1.8. and remove the vulnerable authz pattern.

High remediation recipe for Immutable.js provides many Persistent Immutable data structures. Upgrade to fixed in versions 4.3.9 and 5.1.8. and remove the vulnerable authz pattern.

High remediation recipe for linkify-it is a links recognition library with full Unicode support. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchan. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable use-after-free pattern.

High remediation recipe for Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action ca. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Webbeyaz. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable sql-injection pattern.

Critical remediation recipe for IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL inject. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable sql-injection pattern.

High remediation recipe for A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and e. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

Critical remediation recipe for Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improp. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable credential-leak pattern.

Critical remediation recipe for Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for An improper access check allows unauthorized users to access com_privacy datasets. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for An improper access check allows unauthorized users to create custom fields via webservices endpoints. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Actual is a local-first personal finance app. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for DataEase is an open source data visualization and analysis tool. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Coder allows organizations to provision remote development environments via Terraform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Langflow Authorization Bypass Through User-Controlled Key Vulnerability. Upgrade to Apply mitigations or fixed release per vendor/CISA KEV instructions and remove the vulnerable command-injection pattern.

High remediation recipe for FastGPT is an open source AI knowledge base platform. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for DataEase is an open source data visualization and analysis tool. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Joomlack Page Builder Improper Access Control Vulnerability. Upgrade to Apply mitigations or fixed release per vendor/CISA KEV instructions and remove the vulnerable command-injection pattern.

High remediation recipe for Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable ssrf pattern.

Critical remediation recipe for mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable ssrf pattern.

Critical remediation recipe for LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoi. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable ssrf pattern.

High remediation recipe for The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validatin. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Memory Corruption when processing asynchronous input parameters due to improper handling of modified values be. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Suppo. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Suppo. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerabili. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileg. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

Critical remediation recipe for Traefik is an HTTP reverse proxy and load balancer. Upgrade to fixed in versions v2.11.51 and remove the vulnerable authz pattern.

High remediation recipe for Traefik is an open source HTTP reverse proxy and load balancer. Upgrade to fixed in version v3.7.6. and remove the vulnerable command-injection pattern.

High remediation recipe for vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Upgrade to fixed in version 0.24.0. and remove the vulnerable authz pattern.

High remediation recipe for A flaw was found in GIMP's PNM file format parser. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable credential-leak pattern.

High remediation recipe for Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns tr. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Esri ArcGIS Server contains a directory traversal vulnerability. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tr. Upgrade to Apply the Ubuntu package versions named in the linked USN notice or the upstream fixed release and remove the vulnerable use-after-free pattern.

High remediation recipe for An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of se. Upgrade to Apply the Ubuntu package versions named in the linked USN notice or the upstream fixed release and remove the vulnerable dos pattern.

Critical remediation recipe for libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of the. Upgrade to Apply the Ubuntu package versions named in the linked USN notice or the upstream fixed release and remove the vulnerable authz pattern.

High remediation recipe for By default, curl automatically responds to WebSocket PING frames. Upgrade to Apply the Ubuntu package versions named in the linked USN notice or the upstream fixed release and remove the vulnerable authz pattern.

High remediation recipe for When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect oc. Upgrade to Apply the Ubuntu package versions named in the linked USN notice or the upstream fixed release and remove the vulnerable authz pattern.

Critical remediation recipe for A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handlin. Upgrade to version 3.14.0 allows for arbitrary code execution due to improper h and remove the vulnerable command-injection pattern.

High remediation recipe for An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged u. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticat. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable path-traversal pattern.

High remediation recipe for A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a l. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated p. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

High remediation recipe for An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated pr. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

Critical remediation recipe for A flaw was found in HPLIP (HP Linux Imaging and Printing Software). Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to con. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene. Upgrade to upgrade to version 4.8.0-beta00018 and remove the vulnerable path-traversal pattern.

High remediation recipe for Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene. Upgrade to upgrade to version 4.8.0-beta00018 and remove the vulnerable path-traversal pattern.

Critical remediation recipe for Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis. Upgrade to upgrade to version 4.8.0-beta00018 and remove the vulnerable authz pattern.

High remediation recipe for Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a netwo. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code o. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an una. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to ex. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unau. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a usern. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable credential-leak pattern.

High remediation recipe for ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state, enabling req. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable request-smuggling pattern.

Critical remediation recipe for ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_se. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable memory-corruption pattern.

Critical remediation recipe for Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A relative path traversal in the keyhint option in repomd.xml parsing of libzypp before 17.38.12 can be used. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable path-traversal pattern.

Critical remediation recipe for Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable ssrf pattern.

High remediation recipe for A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (S. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable ssrf pattern.

Critical remediation recipe for A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vul. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in U. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable auth-bypass pattern.

High remediation recipe for A malicious actor with access to the network and under certain conditions could exploit an Improper Initializa. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable auth-bypass pattern.

High remediation recipe for A malicious actor with access to the network and low privileges and under certain conditions could exploit an. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (S. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable ssrf pattern.

Critical remediation recipe for A malicious actor with access to the network and under certain network configurations could exploit an Imprope. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable ssrf pattern.

High remediation recipe for In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who i. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable deserialization pattern.

Critical remediation recipe for A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for DVP80ES3 with Improper Resource Shutdown or Release vulnerability. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnera. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for AS228T with Authentication Bypass Vulnerability. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable auth-bypass pattern.

High remediation recipe for An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5:. Upgrade to fixed in the RAR3 path only in WinRAR 6.23 and remove the vulnerable authz pattern.

High remediation recipe for DVP80ES300T with Improper Validation of Array Index Vulnerability. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary fil. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to caus. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cau. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to caus. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attac. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cau. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cau. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for In Modem, there is a possible memory corruption due to a missing bounds check. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for A vulnerability has been identified in the Feast Feature Server’s /save-document endpoint that allows an una. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

High remediation recipe for NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of unt. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable deserialization pattern.

High remediation recipe for NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request fo. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable ssrf pattern.

High remediation recipe for NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of unt. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable deserialization pattern.

High remediation recipe for NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of unt. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable deserialization pattern.

High remediation recipe for NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of unt. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable deserialization pattern.

High remediation recipe for NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dy. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of unt. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable deserialization pattern.

High remediation recipe for NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of co. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of unt. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable deserialization pattern.

High remediation recipe for NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dy. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handlin. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

Critical remediation recipe for NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable auth-bypass pattern.

High remediation recipe for Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Sky. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

Critical remediation recipe for containerd is an open-source container runtime. Upgrade to fixed in versions 2.3.2 and remove the vulnerable command-injection pattern.

High remediation recipe for A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments agains. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for containerd is an open-source container runtime. Upgrade to fixed in versions 2.3.2 and remove the vulnerable command-injection pattern.

High remediation recipe for Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Upgrade to fixed in version 3.17.3. and remove the vulnerable mcp-auth pattern.

Critical remediation recipe for Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote at. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable path-traversal pattern.

Critical remediation recipe for PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll,. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable path-traversal pattern.

High remediation recipe for JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection vulnerabi. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

Critical remediation recipe for JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerab. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerabi. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabe. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename. Upgrade to fixed buffers without bounds checks and remove the vulnerable authz pattern.

High remediation recipe for UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule pa. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message han. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

High remediation recipe for UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB prot. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

Critical remediation recipe for UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. Upgrade to fixed 1000-byte global buffer and remove the vulnerable authz pattern.

High remediation recipe for Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type valida. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which c. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to imprope. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerabi. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

Critical remediation recipe for IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable ssrf pattern.

Critical remediation recipe for IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL co. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_t. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable dos pattern.

High remediation recipe for IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). Upgrade to version 1.9.3. An authenticated attacker can exploit this to access and remove the vulnerable command-injection pattern.

High remediation recipe for IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable request-smuggling pattern.

High remediation recipe for IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forg. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable ssrf pattern.

High remediation recipe for IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the admin. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable xss pattern.

Critical remediation recipe for IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the admin. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable xss pattern.

Critical remediation recipe for IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the admin. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable xss pattern.

High remediation recipe for IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forg. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable ssrf pattern.

High remediation recipe for IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vul. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable path-traversal pattern.

High remediation recipe for FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalizatio. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity inje. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable command-injection pattern.

High remediation recipe for IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStr. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable prototype-pollution pattern.

Critical remediation recipe for DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable prototype-pollution pattern.

High remediation recipe for IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable prototype-pollution pattern.

High remediation recipe for Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised th. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised t. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to execute ar. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote at. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromise. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to e. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to e. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an att. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.4. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a rem. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

Critical remediation recipe for Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had c. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploi. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local att. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compr. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Type Confusion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compro. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comprom. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to execute arbi. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Insufficient validation of untrusted input in Accessibility in Google Chrome prior to 150.0.7871.47 allowed a. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.

High remediation recipe for Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convince. Upgrade to Vendor-fixed release or mitigation named by the upstream advisory and remove the vulnerable authz pattern.