Advisories

Found by Cipher, fixed upstream.

Original vulnerabilities Cipher reported in grid-monitoring and accelerator-control software, 5G cores, health-record systems, embedded systems, and the tools developers use every day. Every entry links to its advisory at the source.

← Field reports & writeups

62 public advisories across 30 projects · Latest entry Oct 27, 2026

Showing all kinds of software

openPDC & openHistorian

Mission-critical & industrial control

CISA ICSA-26-281-02 Oct 8, 2026 Read the writeup →

Critical
The service console deserializes untrusted data before checking the login affected openPDC < 2.9.482, openHistorian < 2.8.585, fixed in openPDC 2.9.482, openHistorian 2.8.585

CVE-2026-100730 CVSS 9.8 CISA advisory ↗
Critical
The Docker image ships a fixed admin password and never forces a change affected openPDC Docker image < 2.9.482, no fix planned

CVE-2026-105278 CVSS 9.8 CISA advisory ↗
High
The adapter loader runs a type's code before checking it is a real adapter affected openPDC < 2.9.477, openHistorian < 2.8.580, fixed in openPDC 2.9.477, openHistorian 2.8.580

CVE-2026-104629 CVSS 8.8 CISA advisory ↗
High
Without logging in, a client can download the full device and measurement map affected openPDC < 2.9.482, openHistorian < 2.8.585, fixed in openPDC 2.9.482, openHistorian 2.8.585

CVE-2026-105281 CVSS 7.5 CISA advisory ↗
Moderate
The STTP publisher accepts unauthenticated connections by default affected openPDC < 2.9.482, openHistorian < 2.8.585, fixed in openPDC 2.9.482, openHistorian 2.8.585

CVE-2026-85479 CVSS 5.3 CISA advisory ↗
Moderate
A logged-in user can use a Modbus connection to scan the internal network affected openPDC < 2.9.482, openHistorian < 2.8.585, mitigation only

CVE-2026-101022 CVSS 4.3 CISA advisory ↗

EPICS Base

Mission-critical & industrial control

CISA ICSA-26-300-01 Oct 27, 2026 Read the writeup →

Critical
An oversized element count wraps the buffer size, and a write overflows the heap affected EPICS Base 7.0.10 and earlier, fixed in EPICS Base 7.0.11

CVE-2026-114595 CVSS 9.8 CISA advisory ↗
High
A length near 4 GiB wraps the size check, and a write lands far out of bounds affected EPICS Base 7.0.10 and earlier, fixed in EPICS Base 7.0.11

CVE-2026-114596 CVSS 8.2 CISA advisory ↗
High
A write claims more elements than it carries, so the server reads past the buffer affected EPICS Base 7.0.10 and earlier, fixed in EPICS Base 7.0.11

CVE-2026-114597 CVSS 7.5 CISA advisory ↗
High
A pre-auth pvAccess message makes the server read data as the wrong type affected EPICS Base 7.0.10 and earlier, fixed in EPICS Base 7.0.11

CVE-2026-114598 CVSS 7.5 CISA advisory ↗

Critical
OpenEMRHealthcare From a nurse-level login to full database extraction affected < 8.3.0, fixed in 8.3.0, published Aug 18, 2026

CVE requested CVSS 9.9 Advisory ↗ Writeup →
Critical
StackGresCloud & data From tenant database owner to OS command execution in the Postgres pod affected ≤ 1.18.8, fixed in 1.19.0, published Jun 26, 2026

CVE-2026-78155 CVSS 9.9 Advisory ↗ Writeup →

BusyBox

Embedded systems & firmware

Oct 14, 2026 Read the writeup →

High
Request smuggling in the httpd reverse proxy: only the first request is rewritten affected ≤ 1.38.0, fix pending

CVE-2026-88829 CVSS 7.2 Red Hat advisory ↗
High
A crafted .deb package writes outside the extraction directory through a symlink affected ≤ 1.38.0, fix pending

CVE-2026-90954 CVSS 7.8 Red Hat advisory ↗
High
A pre-auth TLS handshake message overflows a heap buffer sized in the wrong units affected 1.38.0, fixed in commit 89ac82774

CVE-2026-88830 CVSS 7.5 Red Hat advisory ↗
High
Probing a crafted romfs disk image writes past a 65-byte label buffer affected ≤ 1.38.0, fixed in commit 9073c1d15

CVE-2026-88832 CVSS 7.3 Red Hat advisory ↗
Moderate
A forged length in a DHCP packet underflows udhcpc's size check affected ≤ 1.38.0, fix pending

CVE-2026-88833 CVSS 6.5 Red Hat advisory ↗
Moderate
A non-root user can override the security options fstab sets on a mount affected ≤ 1.38.0, fix pending

CVE-2026-88838 CVSS 5.5 Red Hat advisory ↗
Moderate
A space before a separator in /etc/group sends heap writes out of bounds affected ≤ 1.38.0, fixed in commit c2dec52d3

CVE-2026-88839 CVSS 6.7 Red Hat advisory ↗
Moderate
httpd treats a yescrypt password hash as plaintext, so the hash itself logs in affected ≤ 1.38.0, fixed in commit 9f5cbdcaa

CVE-2026-88837 CVSS 6.5 Red Hat advisory ↗
Moderate
A malformed .deb makes the dpkg parser read past the end of a string affected ≤ 1.38.0, fixed in commit f5a4a02a1

CVE-2026-88835 CVSS 6.1 Red Hat advisory ↗
Moderate
An httpd deny rule with an out-of-range CIDR prefix silently blocks no one affected ≤ 1.38.0, fixed in commit 339e3c62f

CVE-2026-88831 CVSS 5.3 Red Hat advisory ↗
Moderate
A truncated TLS ClientHello makes the server read past the end of the packet affected 1.38.0, fixed in commit e97224f8f

CVE-2026-88840 CVSS 5.3 Red Hat advisory ↗
Low
httpd's login replies reveal which usernames exist in some non-default builds affected ≤ 1.38.0, fix pending

CVE-2026-88834 CVSS 3.7 Red Hat advisory ↗
Low
Removing several packages at once corrupts the dpkg status file affected ≤ 1.38.0, fixed in commits f5a4a02a1, d5cc94063

CVE-2026-88841 CVSS 3.3 Red Hat advisory ↗

FreeRTOS-Plus-TCP

Embedded systems & firmware

Oct 16, 2026

High
A spoofed Router Advertisement changes the device's IPv6 gateway and prefixes affected ≤ 4.4.1, fixed in 4.4.2

CVE-2026-102551 CVSS 7.7 AWS bulletin ↗
Moderate
A forged DNS reply from any address poisons the device's DNS cache affected ≤ 4.4.1, fixed in 4.4.2

CVE-2026-102552 CVSS 5.9 AWS bulletin ↗

authentik

Identity & access

Sep 9, 2026

High
A SAML assertion issued for another app, or replayed, still signs the user in affected ≤ 2026.2.6, ≤ 2026.5.6, ≤ 2026.8.1, fixed in 2026.2.7, 2026.5.7, 2026.8.2

CVE-2026-94612 CVSS 7.4 Advisory ↗
High
An XML comment in a signed SAML login lets an attacker sign in as an existing user affected ≤ 2026.2.5, ≤ 2026.5.4, fixed in 2026.2.6, 2026.5.5

CVE-2026-57580 CVSS 8.7 Advisory ↗

ZITADEL

Identity & access

Jun 22, 2026 Read the writeup →

High
OAuth2 token exchange turns a low-privilege token into access to other apps affected 4.0.0-4.15.2, 3.0.0-3.4.12, fixed in 4.15.3

CVE-2026-56668 CVSS 8.1 Advisory ↗
High
One OAuth client can redeem codes and tokens issued to another affected 4.0.0-4.15.1, 3.0.0-3.4.11, fixed in 4.15.2, 3.4.12

CVE-2026-55672 CVSS 7.4 Advisory ↗

High
AWS SAM CLIDev tools & AI A crafted Terraform resource address runs OS commands as the build user affected 1.63.0 - 1.166.1, fixed in 1.166.2, published Oct 22, 2026

CVE-2026-115414 CVSS 7.8 AWS bulletin ↗
High
Kata ContainersCloud & data A pod's annotations can override Kata's settings and lead to root on the node affected ≤ 4.2.0, fixed in 4.3.0, published Oct 21, 2026

CVE requested CVSS 7.9 Advisory ↗
High
GiteaCloud & data A hostname with two DNS answers lets repository imports reach internal services affected ≤ 1.27.3, fixed in 28.0.0, published Oct 6, 2026

CVE-2026-101029 CVSS 8.5 Advisory ↗
High
MCP TypeScript SDKDev tools & AI Any new session can read and cancel other clients' tasks affected 1.24.0 - 1.31.0, fixed in 1.32.0, published Oct 2, 2026

CVE-2026-111767 CVSS 8.6 Advisory ↗
High
strongSwanNetwork & telecom An authenticated VPN peer can make the IKE daemon use freed memory during a rekey affected 6.0.0 - 6.0.7, fixed in 6.1.0, published Sep 7, 2026

CVE-2026-78133 CVSS 7.5 Advisory ↗ Writeup →
High
OpenMRS FHIR2Healthcare A zero-privilege account could still read patient observations over FHIR affected 4.0.0, fixed in 4.1.0, published Aug 20, 2026

CVE requested CVSS 7.5 Advisory ↗ Writeup →
High
ZephyrEmbedded One unauthenticated Router Advertisement on the local link drives an unbounded write affected 1.8.0 - 4.4.1, fixed in 4.4.2, published Aug 19, 2026

CVE-2026-12633 CVSS 8.1 Advisory ↗ Writeup →
High
Eclipse TheiaDev tools & AI From one visited web page to arbitrary file writes on the IDE host affected ≤ 1.73.1, fixed in 1.74.0, published Aug 11, 2026

CVE-2026-60009 CVSS 8.8 Advisory ↗ Writeup →
High
GLPICloud & data A missing link check lets users read documents they should not see affected 11.0.5 - 11.0.7, fixed in 11.0.8, published Jul 27, 2026

CVE-2026-53626 CVSS 7.1 Advisory ↗
High
Hasura GraphQLCloud & data Filters on computed fields reveal values from rows a user cannot see affected < 2.49.2, 2.45.0-2.45.4, fixed in 2.49.2, 2.45.5, published Jun 29, 2026

CVE-2026-54698 CVSS 7.7 Advisory ↗ Writeup →
High
GraphicsMagickDev tools & AI A crafted PCD image triggers an attacker-controlled heap overflow affected ≤ 1.3.47, fixed in 1.3.48, published Jun 24, 2026

CVE-2026-77118 CVSS 8.1 Upstream fix ↗ Writeup →
High
Open5GSNetwork & telecom One unauthenticated NAS message triggers an out-of-bounds read in the 5G AMF affected ≤ 2.7.7, fixed in 2.8.0, published Jun 5, 2026

CVE-2026-15720 CVSS 8.6 Advisory ↗ Writeup →

Vim

Developer tools, browsers & AI

Jun 26, 2026 Read the writeup →

Moderate
A hostile tags file turns C completion into shell command execution affected < 9.2.0735, fixed in 9.2.0735

CVE-2026-59858 Advisory ↗
Moderate
Long words trigger a stack overwrite in single-byte soundfolding affected < 9.2.0698, fixed in 9.2.0698

CVE-2026-57455 Advisory ↗
Moderate
Out-of-bounds read decrypting a file shorter than its own header affected < 9.2.0671, fixed in 9.2.0671

CVE-2026-57452 CVSS 5.5 Advisory ↗
Moderate
A crafted undo file pushes text-property reads out of bounds affected < 9.2.0670, fixed in 9.2.0670

CVE-2026-57451 CVSS 5.3 Advisory ↗
Moderate
A crafted filename turns netrw deletion into shell command execution affected < 9.2.0663, fixed in 9.2.0663

CVE-2026-55895 Advisory ↗
Moderate
A spell file's prefix trie pushes stack writes out of bounds affected < 9.2.0662, fixed in 9.2.0662

CVE-2026-55892 CVSS 5.5 Advisory ↗
Moderate
Unguarded since 2006: out-of-bounds stack writes in spell-file word tries affected < 9.2.0653, fixed in 9.2.0653

CVE-2026-55693 Advisory ↗

ThreadX USBX

Embedded systems & firmware

Oct 2, 2026

Moderate
A USB device's truncated HID descriptor makes the host read past its buffer affected ≤ 6.5.1.202602, fixed in 6.5.2.202603

CVE-2026-96582 CVSS 4.9 Advisory ↗
Moderate
A USB camera's inflated length field makes the host read past its buffer affected ≤ 6.5.1.202602, fixed in 6.5.2.202603

CVE-2026-96406 CVSS 4.9 Advisory ↗

Yamcs

Mission-critical & industrial control

Oct 1, 2026

Moderate
An anonymous replication peer makes the server load and initialize any class it names affected < 5.13.6, fixed in 5.13.6

CVE requested CVSS 5.3 Advisory ↗
Moderate
Telemetry denied over REST, streamed over WebSocket affected ≤ 5.12.7, 5.13.0-5.13.1, fixed in 5.12.8, 5.13.2

CVE-2026-55545 CVSS 6.5 Advisory ↗

dash

Developer tools, browsers & AI

Sep 29, 2026

Moderate
Crafted filenames make a script's wildcard pattern hang on backtracking affected ≤ 0.5.13.5, fix pending

CVE-2026-102473 CVSS 5.5 Red Hat advisory ↗
Moderate
A Unicode escape in printf writes up to six bytes into a four-byte reservation affected 0.5.13 - 0.5.13.5, fix pending

CVE-2026-102474 CVSS 4.0 Red Hat advisory ↗

Moderate
ChromeDev tools & AI A crafted web page triggers a use-after-free in Chrome's compositor affected < 156.0.8078.47, fixed in 156.0.8078.47, published Oct 20, 2026

CVE-2026-113111 Release notes ↗
Moderate
ThreadX NetX DuoEmbedded A crafted DTLS handshake makes the server read past its buffer affected ≤ 6.5.2.202603, fixed in 6.5.2.202603a, published Oct 13, 2026

CVE-2026-102712 CVSS 6.3 Advisory ↗
Moderate
coturnNetwork & telecom Alternate IPv6 address forms slip past the relay's block list to internal hosts affected ≤ 4.13.0, fixed in 4.13.1, published Aug 5, 2026

CVE-2026-73212 CVSS 5.8 Advisory ↗ Writeup →
Moderate
BACnet StackIndustrial control One WriteGroup packet reaches a pre-auth out-of-bounds read affected ≤ 1.5.0, fixed in 1.4.5, 1.5.1, 1.6.0, published Jul 5, 2026

CVE-2026-64675 CVSS 5.3 Advisory ↗
Moderate
Supabase RealtimeCloud & data Presence updates delivered despite an explicit read-access denial affected ≤ 2.111.1, fixed in 2.111.2, published Jun 25, 2026

CVE-2026-62247 CVSS 6.5 Advisory ↗ Writeup →
Moderate
7-ZipDev tools & AI Just listing a crafted ext2/3/4 image triggers a heap over-read affected ≤ 26.01, fixed in 26.02, published Jun 25, 2026

CVE requested CVSS 6.5 Release notes ↗ Writeup →