nginx Forged TLS sessions bypass client-certificate checks high published 14 Oct 2026 ▾
K2 Expired price override blocks all liquidations high confirmed 22 Aug 2026 ▾
WordPress Core Pre-auth SSRF to internal and cloud-metadata endpoints via wp_http_validate_url() critical duplicate 06 Aug 2026 ▾
ZenML Cross-tenant stack enumeration medium published 21 Jul 2026 ▾
nginx Request smuggling through a CONNECT body high confirmed 26 Jun 2026 ▾
nginx Image-size parser reads beyond received data low confirmed 26 Jun 2026 ▾
nginx Proposed limits on image-processing memory not assigned proposed hardening 26 Jun 2026 ▾
Aurora Controller Uninitialised upgrade delay enables immediate takeover critical confirmed 01 Jun 2026 ▾
Claude Desktop SSH host-key validation bypass enabling man-in-the-middle high duplicate 28 May 2026 ▾
Omni Bridge Permanent delegate enables bridge-vault drain high confirmed 21 May 2026 ▾
dYdX Message filters fail open and expose sub-accounts critical confirmed 19 May 2026 ▾
Monetrix Phantom yield inflates the sUSDM exchange rate high confirmed 19 May 2026 ▾
Monetrix Duplicate asset accounting creates false backing high confirmed 19 May 2026 ▾
Redacted Oracle manipulation triggering liquidations medium confirmed 19 May 2026 ▾
Aurora Engine Two upgrade paths enable engine takeover critical confirmed 17 May 2026 ▾
Aurora Engine Stale staged code enables permissionless rollback high confirmed 17 May 2026 ▾
ZKSAFE Weak trusted setup allows forged proofs critical disclosed 11 May 2026 ▾
ZKSAFE Unrestricted minting enables wallet takeover critical disclosed 11 May 2026 ▾
ZKSAFE Unrestricted password reset enables wallet takeover critical disclosed 11 May 2026 ▾
ZKSAFE Wallet passwords exposed to offline guessing high disclosed 11 May 2026 ▾
ZKSAFE Arbitrary sender parameter enables token theft high disclosed 11 May 2026 ▾
ZKSAFE Unrestricted verification can disable a wallet medium disclosed 11 May 2026 ▾
ZKSAFE Final stream withdrawal reverts medium disclosed 11 May 2026 ▾
TensorRT Code execution through unsafe model deserialisation critical disclosed 29 Apr 2026 ▾
TensorRT Heap overflow in the ONNX EyeLike operator critical disclosed 29 Apr 2026 ▾
TensorRT Unchecked offset/length in the ONNX external-weights parser enables an out-of-bounds read high duplicate 29 Apr 2026 ▾
BTC Light Client Invalid transaction-inclusion proofs accepted high confirmed 27 Apr 2026 ▾
ModelDB Unauthenticated file write leading to code execution critical disclosed 21 Apr 2026 ▾
ModelDB Unrestricted access to model metadata critical disclosed 21 Apr 2026 ▾
ModelDB Request routing controlled by a forwarded header high disclosed 21 Apr 2026 ▾
ModelDB Unsafe object deserialisation in the Scala client high disclosed 21 Apr 2026 ▾
ModelDB Stored script injection in experiment comments medium disclosed 21 Apr 2026 ▾
Aurora Forwarder Shared hardcoded key controls deployed forwarders high confirmed 17 Apr 2026 ▾
ggplot Code execution through plotting expressions critical disclosed 15 Apr 2026 ▾
GPTCache Code execution through an unvalidated model name critical disclosed 14 Apr 2026 ▾
GPTCache Code execution through unsafe YAML loading critical disclosed 14 Apr 2026 ▾
GPTCache Storage redirected through a database connection string high disclosed 14 Apr 2026 ▾
GPTCache SQL injection in the PGVector backend high disclosed 14 Apr 2026 ▾
Aurora ETH Connector Uninitialised upgrade delay exposes the ETH bridge high confirmed 07 Apr 2026 ▾
Roundcube IMAP injection in mail search low published 03 Apr 2026 ▾
Olas Buyback trades exposed to MEV extraction high confirmed 14 Mar 2026 ▾
FreeRDP Memory corruption from a malicious RDP server high published 25 Feb 2026 ▾
FreeRDP Memory corruption in the planar decoder high published 25 Feb 2026 ▾
FreeRDP Client crash through smartcard alignment padding medium published 25 Feb 2026 ▾
XION Excessive JWT claims can disrupt processing high confirmed 12 Feb 2026 ▾
SSV Network Accounting overflow blocks withdrawals high confirmed 12 Feb 2026 ▾
VII Finance Liquidation rounding takes excess collateral high confirmed 26 Jan 2026 ▾
Firedancer Validator crash in the CALL_REG handler high confirmed 12 Jan 2026 ▾
Rust
Go
Python
JavaScript
TypeScript
Java
Scala
C / C++
C#
PHP
Solidity
Move
APIs / Web