CVE-2026-50010

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends...

UBUNTU-CVE-2026-45416

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates...

CVE-2026-50083 Aqara hardcoded OAuth client credentials

The Aqara IAM/SSO Gateway gw-builder.aqara.com used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N 9.1 Critical. When combined with CVE-2026-50082, CVE-50084, a...

CVE-2026-50083

The CVE-2026-50083 entry concerns the Aqara IAM/SSO Gateway (gw-builder.aqara.com) using a hardcoded OAuth client credential (CWE-798). This weak credential could enable a fully unauthenticated, remote takeover when combined with CVE-2026-50082, CVE-50084, and CVE-50085. Documented CVSSv3.1 base ...

CVE-2026-50010 Netty's wrapping plain trust manager silently disables hostname verification

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends...

CVE-2026-47139 vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes...

CVE-2026-47139 vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes...

CVE-2026-47139 vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes...

CVE-2026-47139

vm2 NodeVM burlon bypass vulnerability exists where public network modules are blocked but internal underscored HTTP builtins (_http_client, _http_server) remain reachable. The issue allows sandboxed code to perform outbound HTTP requests and open listening sockets despite network exclusions, ena...

CVE-2026-45416

Netty CVE-2026-45416 affects pre-4.1.135.Final and pre-4.2.15.Final versions. In SslClientHelloHandler.decode(), the 24-bit TLS handshake length is read and, if a ClientHello does not fit in the first record, Netty eagerly allocates ctx.alloc().buffer(handshakeLength). If maxClientHelloLength is ...

Panic decoding a malformed `hstore` value allows denial of service

A malicious or compromised server can return a binary hstore value with an invalid internal length field, causing the client to panic while decoding it. Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied...

no.ks.fiks:adresseregisteret-client (>=1.5.0 <=1.6.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0 <=1.6.0) +13 more potentially affected by CVE-2026-50629 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0 <=4.2.1)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.1 Source cves: CVE-2026-50629 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339177...

no.ks.fiks:adresseregisteret-client (>=1.0.0 <=1.4.0), no.ks.fiks:fastlegeregisteret-client (>=1.0.0 <=1.4.0) +15 more potentially affected by CVE-2026-50629 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0 <=4.1.6)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =4.7.0, =4.0.0, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.6 and more Source cves: CVE-2026-50629 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339177...

no.ks.fiks:adresseregisteret-client (>=1.0.0 <=1.4.0), no.ks.fiks:fastlegeregisteret-client (>=1.0.0 <=1.4.0) +15 more potentially affected by CVE-2026-50628 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0 <=4.1.6)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =4.7.0, =4.0.0, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.6 and more Source cves: CVE-2026-50628 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339176...

no.ks.fiks:adresseregisteret-client (>=1.5.0 <=1.6.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0 <=1.6.0) +13 more potentially affected by CVE-2026-50623 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0 <=4.2.1)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.1 Source cves: CVE-2026-50623 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339178...

no.ks.fiks:adresseregisteret-client (>=1.5.0 <=1.6.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0 <=1.6.0) +13 more potentially affected by CVE-2026-50627 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0 <=4.2.1)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.1 Source cves: CVE-2026-50627 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339181...

no.ks.fiks:adresseregisteret-client (>=1.0.0 <=1.4.0), no.ks.fiks:fastlegeregisteret-client (>=1.0.0 <=1.4.0) +16 more potentially affected by CVE-2026-50634 via org.apache.cxf:cxf-rt-rs-security-jose-jaxrs (>=4.0.0 <=4.1.6)

org.apache.cxf:cxf-rt-rs-security-jose-jaxrs MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =4.7.0, =4.0.0, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.6 and more Source cves: CVE-2026-50634 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339189...

no.ks.fiks:adresseregisteret-client (>=1.5.0 <=1.6.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0 <=1.6.0) +14 more potentially affected by CVE-2026-50634 via org.apache.cxf:cxf-rt-rs-security-jose-jaxrs (>=4.2.0 <=4.2.1)

org.apache.cxf:cxf-rt-rs-security-jose-jaxrs MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.1 and more Source cves: CVE-2026-50634 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339189...

no.ks.fiks:adresseregisteret-client (>=1.0.0 <=1.4.0), no.ks.fiks:fastlegeregisteret-client (>=1.0.0 <=1.4.0) +15 more potentially affected by CVE-2026-50630 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0 <=4.1.6)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =4.7.0, =4.0.0, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.6 and more Source cves: CVE-2026-50630 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339182...

no.ks.fiks:adresseregisteret-client (>=1.0.0 <=1.4.0), no.ks.fiks:fastlegeregisteret-client (>=1.0.0 <=1.4.0) +15 more potentially affected by CVE-2026-50631 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0 <=4.1.6)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =4.7.0, =4.0.0, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.6 and more Source cves: CVE-2026-50631 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339183...