Advisories
Found by Cipher, fixed upstream.
Original vulnerabilities Cipher reported in widely deployed open-source and embedded software: identity infrastructure, a 5G core, data platforms, building automation, and the tools developers live in. Each row links to its upstream advisory. New entries publish as embargoes lift.
← Field reports & writeups Advisory ledger Ordered by severity, then date · Latest entry Oct 2, 2026
- OpenEMRCVSS 9.9 CWE-89 affected < 8.3.0 fixed 8.3.0 Aug 18, 2026
- StackGres
- MCP TypeScript SDKHigh From one new session to every other client's task resultsCVSS 8.6 CWE-639 affected 1.24.0 - 1.31.0 fixed 1.32.0 Oct 2, 2026
- authentikHigh Signature checked, audience and reuse not: a SAML assertion signs in as its subjectCVSS 7.4 CWE-287 affected ≤ 2026.2.6, ≤ 2026.5.6, ≤ 2026.8.1 fixed 2026.2.7, 2026.5.7, 2026.8.2 Sep 9, 2026
- strongSwan
- OpenMRS FHIR2CVSS 7.5 CWE-862 affected 4.0.0 fixed 4.1.0 Aug 20, 2026
- Eclipse Theia
- Hasura GraphQL
- GraphicsMagick
- ZITADEL
- ZITADELCVE-2026-55672 CVSS 7.4 CWE-287 affected 4.0.0-4.15.1, 3.0.0-3.4.11 fixed 4.15.2, 3.4.12 Jun 17, 2026
- ThreadX USBXModerate A HID report descriptor truncated mid-item reads past its heap buffer at enumeration
- ThreadX USBXModerate A USB camera's inflated wTotalLength walks the host past its descriptor buffer
- YamcsModerate An anonymous replication peer makes the server load and initialize any class it namesCVSS 5.3 CWE-470 affected < 5.13.6 fixed 5.13.6 Oct 1, 2026
- dashModerate Planted filenames stall a script's multi-star glob in super-polynomial backtracking
- dashModerate A Unicode escape in printf writes up to six bytes into a four-byte reservation
- BusyBox
- BusyBox
- YamcsModerate Telemetry denied over REST, streamed over WebSocket
- BACnet StackModerate One WriteGroup packet reaches a pre-auth out-of-bounds read
- Supabase Realtime
- CVSS 6.5 CWE-125 affected ≤ 26.01 fixed 26.02 Jun 25, 2026