CVE Vulnerability Advisory Database

[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.

[Impact] Attackers can bypass authentication using crafted JWTs, leading to full administrative account takeover.

[Mitigation] Apply official vendor patches immediately and enforce strict JWT algorithm validation policies.

[Affected Scope] N-able N-central versions up to and including 2026.3.1

[Impact] Attackers can bypass authentication and achieve full account takeover by exploiting an incomplete patch for CVE-2026-18556

[Mitigation] Immediately upgrade to N-central 2026.3 Hotfix 1 or later, and restrict external access to the management interface until patched

[Affected Scope] Langflow versions up to and including 1.6.9

[Impact] Attackers can hijack victim sessions to take over accounts and execute arbitrary code via built-in code execution features, leading to full system compromise

[Mitigation] Upgrade Langflow to the latest patched version, restrict CORS configurations, and update refresh token cookie attributes to Lax/Strict

[Affected Scope] SysAid On-Prem versions <= 23.3.40

[Impact] Unauthenticated remote attackers can exploit the Server URL processing logic to read arbitrary files, hijack administrator accounts, and potentially achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade SysAid On-Prem to the patched version (24.40.60 or higher) and restrict external access to the application

[Affected Scope] SysAid On-Prem versions 23.3.40 and below

[Impact] Unauthenticated remote attackers can read arbitrary system files and perform administrator account takeover, leading to full system compromise.

[Mitigation] Immediately upgrade SysAid On-Prem to version 24.4.60 or higher, and restrict external access to the Checkin endpoint prior to patching.

[Affected Scope] Palo Alto Networks Expedition versions prior to 1.2.92

[Impact] Attackers with network access can bypass authentication to take over the Expedition administrator account, exposing firewall configurations, credentials, and API keys

[Mitigation] Immediately upgrade Expedition to version 1.2.92 or later, and restrict network access to authorized administrator IPs only

[Affected Scope] GitLab CE/EE versions 16.1 to 16.7.1 (prior to 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, and 16.7.2)

[Impact] An unauthenticated remote attacker can trigger password reset emails to be sent to an arbitrary, unverified email address, leading to complete account takeover.

[Mitigation] Immediately upgrade GitLab instances to the patched versions (16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2 or later) and enforce Multi-Factor Authentication (MFA).