vulnerability in 9router (CVE-2026-49352). Successful exploitation can lead to full system takeover. Exploitable via ``JWT_SECRET``. Mitigation: upgrade to `0.4.45` or later.
vulnerability in pro.gravit.launcher:launchserver-api (CVE-2026-54617). Successful exploitation can lead to full system takeover. Exploitable via `GET /../../.keys/ecdsa_id`.
vulnerability in simplesamlphp/simplesamlphp (CVE-2026-49284). Data can be tampered with by attackers. Exploitable via ``SubjectConfirmationData``. Mitigation: upgrade to `2.4.7` or later.
vulnerability in github.com/xyproto/algernon (CVE-2026-52792). Risk of unauthorized operations or information disclosure. Exploitable via ``x.lua.``. Mitigation: upgrade to `1.17.9` or later.
vulnerability in jxl-oxide (GHSA-66m8-c62j-h6v5). Risk of unauthorized operations or information disclosure. Exploitable via ``FrameBuffer``. Mitigation: upgrade to `0.12.6` or later.
vulnerability in jxl-modular (GHSA-2v8p-fqpx-2q3w). Risk of unauthorized operations or information disclosure. Exploitable via ``decode_simple_table_slow``. Mitigation: upgrade to `0.11.3` or later.
vulnerability in kimai/kimai (GHSA-j5mc-p8qg-39j7). Risk of unauthorized operations or information disclosure. Exploitable via `GET /en/favorite/timesheet/add/{id}`. Mitigation: upgrade to `2.57.0` or later.
path traversal in fast-mcp-telegram (CVE-2026-52830). Confidential information can be exposed externally. Exploitable via ``telegram``. Mitigation: upgrade to `0.19.1` or later.