How CVE-2026-83548 Works CVE-2026-83548 is a critical pre‑authentication Server‑Side Request Forgery (SSRF) vulnerability that resides in the Appliance Work Place
The OpenChoreo control-plane cluster-gateway contained a critical vulnerability that allowed unauthenticated remote attackers to invoke privileged data-plane operations. The flaw
The @platejs/docx-io library, a component of the Plate rich-text editor, is vulnerable to a high-severity Server-Side Request Forgery (SSRF) attack
The disclosed vulnerability stems from an incomplete fix for CVE‑2026‑33311. That earlier advisory addressed XML‑escaping for string‑typed options (backgroundColor, fontFamily,
The vulnerability exists because the Twig content sandbox in Grav CMS improperly handles object serialization after a partial fix for
CVE-2026-61704 details a DNS Rebinding Server-Side Request Forgery (SSRF) bypass in the `link-preview-js` library, affecting versions prior to 4.0.4. This
The Starlette ASGI framework prior to version 1.0.1 is vulnerable to a host header validation bypass that allows attackers to
Mailpit’s SMTP server reads each command line with an unbounded `bufio.Reader.ReadString(‘\n’)` before parsing the command or enforcing any protocol length
The vulnerability in fast-uri arises from improper validation of bracketed IPv6 literals against the complete RFC 3986 grammar. When the
The vulnerability stems from the `AuthenticationFilter` in Kestra OSS, which uses `request.getPath().endsWith(“/configs”)` as a suffix-based whitelist to exempt the public
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to versions 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates
fast-uri is a URI parser for Node.js. During parsing, it runs a legacy decoding pass over the scheme component using
OpenChoreo is an open-source developer platform for Kubernetes. CVE-2026-73841 is an authorization bypass vulnerability affecting the OpenChoreo API server (openchoreo-api),
How CVE-2026-83549 Works CVE-2026-83549 is a post-authentication OS command injection vulnerability discovered in the Appliance Management Console (AMC) of SonicWall
fast-uri is a high‑performance URI parsing library for Node.js, commonly used in Fastify and related middleware. A high‑severity vulnerability arises
The vulnerability (related to GHSA-jrrm-9hc7-2v3h but distinct) stems from Omnigent’s agent‑bundle pipeline unconditionally trusting the `os_env.cwd` field supplied by an
The vulnerability resides in Grav CMS’s ZipArchiver::extract() method, which lacks any limits on decompressed size, file count, or nesting depth
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to version 0.3.0, the multipart POST
The `fast-uri` library, a popular URI parser for Node.js, is vulnerable to a Server-Side Request Forgery (SSRF) attack due to
When two-factor authentication (2FA) is enabled on a Grav CMS account, the authentication flow operates in two stages. First, the
CVE-2026-82329 is a critical improper authentication vulnerability in JFrog Artifactory that enables unauthenticated attackers with network access to obtain full
Mailpit’s thumbnail endpoint at `/api/v1/message/{id}/part/{partID}/thumb` fails to validate image dimensions before decoding. The handler accepts any attachment with a `Content-Type`
CVE-2026-9586 is a critical unauthenticated SQL injection vulnerability discovered in Sangoma Switchvox SMB Edition version 8.3 (build 104997). The flaw
Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to version 2.9.1, the
Scrapy’s S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless
CVE-2026-72920 is a critical Missing Authentication for Critical Function vulnerability (CWE-306) identified in SeaweedFS, a distributed storage system. The flaw
@tiptap/core’s public `mergeAttributes()` helper uses ordinary bracket assignment on keys returned by Object.entries(). An own `__proto__` key from JSON therefore
The `qs` library is a popular querystring parsing utility for Node.js, offering features like nesting and array support with configurable
qs.stringify() calls utils.isBuffer() on every value it serializes as part of its encoding loop. The internal function utils.isBuffer(), defined in
The vulnerability stems from a missing authorization enforcement within Sulu’s preview link generation mechanism. Sulu, a Symfony‑based CMS, provides a
Orval is an open-source tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A
Orval’s Zod client generation is vulnerable to an injection flaw due to improper escaping of double quotes in schema property
elFinder is an open-source web-based file manager, widely integrated into content management systems and enterprise applications. It provides `uploadDeny` and
Orval is a TypeScript client generator that processes OpenAPI v3 and Swagger v2 specifications to produce type‑safe API clients. Prior
The NLTK (Natural Language Toolkit) library provides a widely used PorterStemmer implementation for stemming English words. The public API `nltk.stem.PorterStemmer.stem()`
CVE-2026-71553 describes a second‑order prototype pollution vulnerability in ApostropheCMS, an open‑source Node.js content management system. The flaw resides in the
Sulu is an open-source PHP content management system built on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, a
EasyAdmin is a modern admin generator for Symfony applications. From version 4.0.0 up to (but not including) 4.29.16, and from
– How CVE-2026-81887 Works Livewire is a full-stack framework for Laravel that enables dynamic UI updates without page reloads by
The vulnerability exists in the media download endpoint of Sulu CMS, specifically the routes `/media/{id}/download/{slug}` and its admin counterpart. When
This vulnerability exists in Grav CMS where an authenticated user with admin.pages or api.pages.write permission can execute arbitrary shell commands
The @apostrophecms/import-export module reconstructs the on-disk source path of every imported attachment from JSON metadata contained in the uploaded archive.
When resolving a package, pnpm uses the resolved manifest name as a raw path segment for the isolated-linker import target.
The virtual store linker constructs package installation directories using path.join(modules, pkgName), where `pkgName` is extracted from lockfile `packages` keys via
pypdf is a free and open-source pure-python PDF library. Prior to version 6.15.0, the library contains an algorithmic complexity vulnerability
The vulnerability arises from an incomplete filesystem containment check within Kirby’s media handler. When a request for an uncached thumbnail
SiYuan is an open-source personal knowledge management system. Prior to version 3.7.1, the block search endpoint `POST /api/search/fullTextSearchBlock` concatenates attacker-controlled
The vulnerability resides in the `/snippets/filepath` route handler (serveSnippets in kernel/server/serve.go). Unlike sibling handlers (/export/, /appearance/, /assets/) that enforce `IsSubPath`
How CVE-2026-71488 Works This vulnerability affects the PHP library league/commonmark, which is used to parse and render Markdown. It allows
The vulnerability resides in the authentication flow of Filament when Multi-Factor Authentication (MFA) is enabled. Normally, the login process validates
CVE-2026-84310 is a moderate-severity vulnerability in the pypdf library, a pure-Python PDF toolkit widely used for document processing. The flaw
pypdf is a free and open-source pure-Python PDF library widely used for parsing, manipulating, and extracting content from PDF documents.
How CVE-2026-84371 Works CVE-2026-84371 is a stored Cross-Site Scripting (XSS) vulnerability affecting the `sanitize-html` npm package, a widely-used HTML sanitizer.
Technical Overview CVE-2026-84306 is a vulnerability in Filament, a collection of full-stack components for accelerated Laravel development. The flaw resides
How CVE-2026-84304 Works gRPC-Go is the Go language implementation of gRPC. Prior to version 1.83.1, the package `internal/transport/transport.go` contained a
How CVE-2026-84309 Works pypdf is a free and open-source pure-Python PDF library used for splitting, merging, cropping, and transforming PDF
NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in `dependencygraph.dot2img` and AlignedSent._repr_svg_,
The vulnerability identified as CVE-2026-31958 affects the Tornado Python web framework, a popular asynchronous networking library. This issue represents a
This vulnerability affects the league/commonmark Markdown parser for PHP. It stems from three distinct algorithmic complexity issues found in two
The league/commonmark PHP library provides an opt-in AttributesExtension that allows users to attach HTML attributes to Markdown elements. When this
The CVE-2026-35536 patch introduced a validation loop that rejects control characters ([\x00-\x20\x3b\x7f]) in cookie attribute values【0†L1-L2】. However, this validation was
The League CommonMark AttributesExtension allows users to attach HTML attributes via a Markdown syntax like {id .class}. Its security guarantee
The recently patched CVE-2026-12841 addressed a JVM argument injection vulnerability by introducing the `_validate_java_options()` function, designed to block dangerous flags
When SQL is formatted with reindentation enabled, the `ReindentFilter` repeatedly rebuilds prefixes of the current statement to calculate token offsets.
CVE-2026-73086 is an integer overflow vulnerability identified in the popular JavaScript library nanoid. This library is widely used for generating
Django REST Framework (DRF) is a powerful and flexible toolkit for building Web APIs. Prior to version 3.17.2, a vulnerability
How CVE-2026-73228 Works CVE-2026-73228 is a vulnerability in Django REST Framework (DRF) that allows oversized HTTP request bodies to bypass
pnpm expands `${VAR}` environment placeholders in the httpProxy, httpsProxy, and `noProxy` settings read from a project’s pnpm-workspace.yaml. Because a project
Appium is a cross-platform automation framework built on top of the W3C WebDriver protocol. Prior to version 10.7.0, a critical
The vulnerability arises from how pacquet, a Rust-based package manager, handles dependency aliases within lockfiles. When a project is installed
This vulnerability, identified as CVE-2026-73089, resides in the `index.js` file of the `browserslist` npm package, specifically within the `cache` object
MLflow introduced MLFLOW_ALLOW_PICKLE_DESERIALIZATION as a security control to prevent unsafe pickle.load execution during model loading, in response to CVE-2024-37052 through
When a Security policy is active in Smarty, the `{fetch}` function validates the requested remote URL against the `trusted_uri` allowlist
How CVE-2026-55215 Works The vulnerability resides in how the mysql2 driver handles authentication plugin switching. When a MySQL server initiates
The vulnerability in CVE-2024-52815 stems from Kirby’s REST API error‑handling logic, specifically how the framework transforms unhandled PHP exceptions into
to CVE-2025-38839 CVE-2025-38839 is a vulnerability discovered in the popular Browserslist library (versions prior to 4.28.6) that combines two critical
CVE-2026-71415 is a missing authorization vulnerability in Kirby CMS that affects versions 5.0.0 through 5.5.1. The flaw resides in the
The `decode-uri-component` package is a widely used Node.js library for decoding URI components, such as query strings and path segments.
The identified vulnerability resides in Kirby’s media thumbnail generation handler, specifically affecting deployments on servers that permit encoded slashes (%2f)
The vulnerability exists in Engine.IO servers that have WebTransport support explicitly enabled. WebTransport is a modern protocol that runs over
The built-in social login providers in `@hono/oauth-providers` accept an OAuth callback even when the `state` value is absent on both
elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass when PHP cURL is unavailable and URL uploads
How CVE-2026-15305 Works This vulnerability resides in the Form Framework (ext:form) of TYPO3 CMS. The core issue is a server-side
CVE ID: CVE-2026-82078 Intro: CVE-2026-82078 is a critical unsafe dynamic class loading vulnerability present in the database connection utilities of
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG, tracked as CVE-2026-81578
The AUSF (Authentication Server Function) component of the free5GC 5G core network implements two primary authentication procedures: 5G-AKA and EAP-AKA’.
SeaweedFS is a distributed storage system designed for object storage (S3), file systems, and Iceberg tables. In versions 4.08 through
The Arc Enterprise clustering mechanism exposes an authentication bypass vulnerability that allows unauthenticated network attackers to join the cluster as
When a Java application connects with `sslMode=verify-full` (or verify-ca) and a password but does not pin a server certificate, Connector/J
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to version 2.0.5, a reflected
CVE-2026-55858 is a vulnerability in the MariaDB Connector/J (and by extension, MySQL Connector/J) that arises from an assumption mismatch between
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to version 1.4.1, the connector does not
RestrictedPython is a tool that defines a subset of the Python language, allowing safe execution of untrusted code within a
MariaDB Connector/Node.js is a driver that enables Node.js applications to connect to MariaDB and MySQL databases. A security vulnerability, identified
The SeaweedFS S3 API gateway did not reject `..` path segments in the `X-Amz-Copy-Source` header used by `CopyObject` and UploadPartCopy.
A SQL injection vulnerability exists in MariaDB Connector/Node.js versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3. The flaw resides in
The vulnerability exists in the `processPercentageRoyaltiesTransfer` function of the Klever-Go blockchain node (package core/kapp/accounts/accounts.go). This function handles the distribution of
Snipe-IT is an open-source IT asset and license management system. Prior to version 8.6.0, the application contained an improper privilege
The AUSF (Authentication Server Function) component of free5GC is responsible for managing subscriber authentication within the 5G core network. In
This vulnerability resides in the `silverstripe/versioned` module, which provides versioning capabilities for Silverstripe CMS models. The flaw manifests specifically within
