Abraxas Labs

SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()

ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass

SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()

SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()

OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting

CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation

OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook