Abraxas Labs

Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo

phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting

OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation

Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions

CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type

SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()

ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap

Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create