Advisories

Found by Cipher, fixed upstream.

Name: Cipher
Availability: OnlineOnly

Original vulnerabilities Cipher reported in widely deployed open-source and embedded software: identity infrastructure, a 5G core, data platforms, building automation, and the tools developers live in. Each row links to its upstream advisory. New entries publish as embargoes lift.

← Field reports & writeups

Advisory ledger Ordered by severity, then date · Latest entry Sep 9, 2026

OpenEMR
Critical From a nurse-level login to full database extraction

CVSS 9.9 CWE-89 affected < 8.3.0 fixed 8.3.0 Aug 18, 2026

Read the OpenEMR advisory ↗ Read the writeup →
StackGres
Critical From tenant database owner to OS command execution in the Postgres pod

CVE-2026-78155 CVSS 9.9 CWE-426 affected ≤ 1.18.8 fixed 1.19.0 Jun 26, 2026

Read the StackGres advisory ↗ Read the writeup →
authentik
High Signature checked, audience and reuse not: a SAML assertion signs in as its subject

CVSS 7.4 CWE-287 affected ≤ 2026.2.6, ≤ 2026.5.6, ≤ 2026.8.1 fixed 2026.2.7, 2026.5.7, 2026.8.2 Sep 9, 2026

Read the authentik advisory ↗
strongSwan
High An authenticated peer stalls a rekey collision and drives a call through freed memory

CVE-2026-78133 CVSS 7.5 CWE-416 affected 6.0.0 - 6.0.7 fixed 6.1.0 Sep 7, 2026

Read the strongSwan advisory ↗ Read the writeup →
OpenMRS FHIR2
High A zero-privilege account could still read patient observations over FHIR

CVSS 7.5 CWE-862 affected 4.0.0 fixed 4.1.0 Aug 20, 2026

Read the OpenMRS FHIR2 advisory ↗ Read the writeup →
Zephyr
High One unauthenticated Router Advertisement on the local link drives an unbounded write

CVE-2026-12633 CVSS 8.1 CWE-787 affected 1.8.0 - 4.4.1 fixed 4.4.2 Aug 19, 2026

Read the Zephyr advisory ↗ Read the writeup →
Hasura GraphQL
High Hidden rows, exposed values: inference through computed-field filters

CVE-2026-54698 CVSS 7.7 CWE-863 affected < 2.49.2, 2.45.0-2.45.4 fixed 2.49.2, 2.45.5 Jun 29, 2026

Read the Hasura GraphQL advisory ↗ Read the writeup →
GraphicsMagick
High A crafted PCD image triggers an attacker-controlled heap overflow

CVE-2026-13606 CVSS 8.1 CWE-787 affected ≤ 1.3.47 fixed changeset 937cdd99 Jun 24, 2026

Read the GraphicsMagick fix ↗ Read the writeup →
ZITADEL
High Crossing application boundaries with a low-privilege token through OAuth2 token exchange

CVE-2026-56668 CVSS 8.1 CWE-863 affected 4.0.0-4.15.2, 3.0.0-3.4.12 fixed 4.15.3 Jun 22, 2026

Read the ZITADEL advisory ↗ Read the writeup →
ZITADEL
High Authorization codes and refresh tokens redeemable by a client they were never issued to

CVE-2026-55672 CVSS 7.4 CWE-287 affected 4.0.0-4.15.1, 3.0.0-3.4.11 fixed 4.15.2, 3.4.12 Jun 17, 2026

Read the ZITADEL advisory ↗ Read the writeup →
Open5GS
High One unauthenticated NAS message triggers an out-of-bounds read in the 5G AMF

CVE-2026-15720 CVSS 8.6 CWE-125 affected ≤ 2.7.7 fixed 2.8.0 Jun 5, 2026

Read the Open5GS advisory ↗ Read the writeup →
coturn
Moderate Reaching ACL-blocked internal destinations through IPv6 translation

CVE-2026-73212 CVSS 5.8 CWE-284 affected ≤ 4.13.0 fixed 4.13.1 Aug 5, 2026

Read the coturn advisory ↗ Read the writeup →
Yamcs
Moderate Telemetry denied over REST, streamed over WebSocket

CVE-2026-55545 CVSS 6.5 CWE-862 affected ≤ 5.12.7, 5.13.0-5.13.1 fixed 5.12.8, 5.13.2 Jul 14, 2026

Read the Yamcs advisory ↗
BACnet Stack
Moderate One WriteGroup packet reaches a pre-auth out-of-bounds read

CVE-2026-64675 CVSS 5.3 CWE-125 affected ≤ 1.5.0 fixed 1.4.5, 1.5.1, 1.6.0 Jul 5, 2026

Read the BACnet Stack advisory ↗
Vim
Moderate A hostile tags file turns C completion into shell command execution

CVE-2026-59858 CWE-94 affected < 9.2.0735 fixed 9.2.0735 Jun 26, 2026

Read the Vim advisory ↗ Read the writeup →
7-Zip
Moderate Just listing a crafted ext2/3/4 image triggers a heap over-read

CVSS 6.5 CWE-125 affected ≤ 26.01 fixed 26.02 Jun 25, 2026

Read the 7-Zip release notes ↗ Read the writeup →
Supabase Realtime
Moderate Presence updates delivered despite an explicit read-access denial

CVE-2026-62247 CVSS 6.5 CWE-863 affected ≤ 2.111.1 fixed 2.111.2 Jun 25, 2026

Read the Supabase Realtime advisory ↗ Read the writeup →
Vim
Moderate Long words trigger a stack overwrite in single-byte soundfolding

CVE-2026-57455 CWE-787 affected < 9.2.0698 fixed 9.2.0698 Jun 21, 2026

Read the Vim advisory ↗ Read the writeup →
Vim
Moderate Out-of-bounds read decrypting a file shorter than its own header

CVE-2026-57452 CVSS 5.5 CWE-191 affected < 9.2.0671 fixed 9.2.0671 Jun 18, 2026

Read the Vim advisory ↗ Read the writeup →
Vim
Moderate A crafted undo file pushes text-property reads out of bounds

CVE-2026-57451 CVSS 5.3 CWE-125 affected < 9.2.0670 fixed 9.2.0670 Jun 17, 2026

Read the Vim advisory ↗ Read the writeup →
Vim
Moderate A spell file's prefix trie pushes stack writes out of bounds

CVE-2026-55892 CVSS 5.5 CWE-787 affected < 9.2.0662 fixed 9.2.0662 Jun 16, 2026

Read the Vim advisory ↗ Read the writeup →
Vim
Moderate A crafted filename turns netrw deletion into shell command execution

CVE-2026-55895 CWE-78 affected < 9.2.0663 fixed 9.2.0663 Jun 16, 2026

Read the Vim advisory ↗ Read the writeup →
Vim
Moderate Unguarded since 2006: out-of-bounds stack writes in spell-file word tries

CVE-2026-55693 CWE-787 affected < 9.2.0653 fixed 9.2.0653 Jun 15, 2026

Read the Vim advisory ↗ Read the writeup →

All field reports & writeups →