Author name: UNDERCODE

The vulnerability works as follows in Grav CMS 2.0.16 with the admin plugin. MediaUploadTrait::deleteFile() is intended to delete media files.

The core Flex group blueprint system/blueprints/user/group.yaml access field lines 48-55 omits security@: admin.super. Its sibling account blueprint carries security@ at

djust 1.1.0 shipped five independent defects in template auto-escaping. Attacker-controlled input rendered as live markup where Django escapes it. All

The vulnerability resides in the `Security::detectXss()` function within system/src/Grav/Common/Security.php. This function is the core XSS detection mechanism for Grav, invoked

Kestra is a Java/Micronaut orchestration and data-pipeline platform. It exposes a main API on port 8080. It exposes Micronaut management/actuator

CVE-2026-77410 is a high-severity resource exhaustion vulnerability affecting the RabbitMQ amqp091-go library, a Go AMQP 0.9.1 client, in versions prior

The vulnerability resides in the `readField` function within `read.go` of the RabbitMQ amqp091-go client library. When the client parses incoming

oras-go’s pagination helper parseLink() in registry/remote/utils.go follows the Link response header from a registry without validating the URL’s host or

The AsyncHttpClient (AHC) library is a widely used Java framework that allows applications to execute HTTP requests and process responses

When an application uses an HTTP proxy to reach an HTTPS origin, the client must first establish a tunnel by

The vulnerability exists in @libp2p/gossipsub under StrictSign. StrictSign is the default gossipsub signature policy. The vulnerable function is validateToRawMessage. It

Grav blueprints support action-property@: directives. These YAML keys dynamically compute field values by calling functions. Blueprint::init resolves registered handlers first.

A logic and resource exhaustion vulnerability exists in the AMQP client’s Quality of Service (Qos) configuration method. The Qos function

vLLM main splits request-time video decoding from startup-time GPU memory reservation. Chat Completions and Responses request bodies expose media_io_kwargs. Those

CVE-2026-50197 affected Skipper’s OPA authorization path for chunked requests. The original bug was an empty-body chunked bypass. OPA saw no

CVE-2026-77408 is a critical integer overflow or wraparound vulnerability (CWE-190) in the RabbitMQ amqp091-go client library, affecting all versions prior

The AsyncHttpClient (AHC) library for Java provides asynchronous HTTP request execution. From version 3.0.8 through 3.0.11, the client computes the

The vulnerability is an unauthenticated Server-Side Request Forgery in Kestra OSS. It exists in the Pebble template engine http() function.

CVE-2026-77407 is an information disclosure vulnerability in the RabbitMQ amqp091-go client library, a Go implementation of the AMQP 0.9.1 protocol.

Steeltoe’s `/actuator/httpexchanges` endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the `UserInfo` portion

Grav CMS versions 2.0.7 through 2.0.10 contain an incomplete callable validation vulnerability in the Blueprint dynamic-field directive handler. The method

Grav CMS version 2.0.10 contains a path traversal vulnerability within the `ImageMedium::watermark()` method. This function is part of the core

The target is github.com/getgrav/grav. Affected resource is Grav\Common\Media\Traits\AudioMediaTrait / VideoMediaTrait sourceParsedownElement(). Verified on 2.0.13 latest stable and develop HEAD 5a7070f.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to

Grav CMS implements a page editor that allows users with `admin.login` and `admin.pages` permissions, but without admin.super, to create and

CVE-2026-85756 is an OS command injection vulnerability in SSH.NET, a Secure Shell library for .NET, affecting versions prior to 2026.0.0.

CVE-2026-77411 is a critical stream desynchronization vulnerability in the RabbitMQ amqp091-go library, a Go client for the AMQP 0.9.1 protocol.

Wire’s protobuf decoders did not consistently validate attacker-controlled length-delimited sizes against current reader bounds before computing cursor, limit, or pointer

The @orpc/server CORS plugin in packages/server/src/plugins/cors.ts contained a flaw where it copied a client’s incoming Vary request header directly into

CVE-2026-82410 is a high-severity denial-of-service vulnerability affecting PocketBase, an open-source Go backend framework that combines an embedded SQLite database, authentication,

Sanic’s HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating 0\r\n chunk. Because of that, attacker-controlled bytes

CVE-2026-59823 is a server-side request forgery vulnerability in LiteLLM Proxy, an AI gateway proxy server that routes requests to large

In AMQConnection.java lines 435-436, after Connection.Tune negotiation, frame-max is set using Math.min(this.maxInboundMessageBodySize, frameMax). When frameMax=0, which AMQP spec defines as

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ

Vendure is an open-source headless commerce platform. Prior to version 3.7.0, a critical vulnerability exists in the `ExternalAuthenticationService.createCustomerAndUser()` method. This

CVE-2026-63225 is a path traversal vulnerability (CWE-22) affecting the `split` command in Redocly CLI versions before 2.33.2. The vulnerability arises

AsyncSSH stores peer-supplied channel maximum packet size without a lower-bound check. A malicious SSH server can wedge an AsyncSSH client.

Vulnerability A Windows-specific command injection vulnerability exists in the `@cyclonedx/cyclonedx-npm` CLI tool prior to version 6.0.0. When the tool is

The vulnerability is an incomplete fix for GHSA-928x-9mpw-8h56. Grav 2.0.1 added a decompression-bomb bound in commit 1c1003c. ZipArchiver.php:77-86 sums ZipArchive::statIndex($i)[‘size’]

The Shop API in Vendure provides GraphQL queries for products, collections, and facets. Each of these queries automatically injects a

The issue is in Vendure’s admin dashboard package @vendure/dashboard latest master. RichTextDescriptionCell attempts to strip HTML from entity description. It

Vendure is a headless commerce framework built on Node.js. The vulnerability resides in the public Shop GraphQL API, specifically in

Grav 2.0.0-rc.9 and current 2.0 branch allow stored CSS injection. The issue is in Markdown image media actions. Prior media

The djust.tenants isolation mechanism was enforced only on the HTTP path. The current tenant was stored in `threading.local()` and set

CVE-2025-59953 is a critical insecure deserialization vulnerability (CWE-502) affecting LMDeploy, a toolkit for compressing, deploying, and serving large language models

CVE-2026-76460 is a critical authentication bypass vulnerability in an API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive

CVE-2026-61709 is an authorization-decision over-inclusion vulnerability in the OpenFGA authorization engine, specifically within the ListUsers API evaluation path. The flaw

djust built-in component template tags render developer/user-supplied URLs into href and action attributes. They HTML-escape those URL values with conditional_escape.

CVE-2026-61588 is a medium-severity information disclosure vulnerability affecting djust, a Python framework that provides Phoenix LiveView-style reactive server-side rendering for

DailyCVE Form: Platform: Django djust Version: < 1.0.7 Vulnerability: Auth Bypass Severity: Critical date: 2026-09-17 Prediction: Patched in 1.0.7 What

The `OpenTelemetry.Resources.Host` NuGet package provides resource detectors for host information within the OpenTelemetry observability framework. On macOS, the `host.id` resource

CVE-2026-68904 is a high-severity vulnerability affecting node-opcua, the OPC UA implementation for TypeScript and Node.js. The vulnerability manifests as an

djust is a Django live-view framework. It supports WebSocket and SSE transports. The advisory concerns the SSE transport. SSE sessions

CVE-2026-9586 affects Sangoma Switchvox SMB Edition 8.3 (104997). The vulnerable component is the /pa endpoint. The /pa endpoint accepts XML

CVE-2026-86218 affects N-able N-central. N-central is a remote monitoring and management platform. The vulnerability is a pre-auth remote code execution

CVE-2026-81963 is a Windows Update Stack vulnerability. It is classified as improper link resolution before file access. The common weakness

CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC. ALPC is the Advanced Local Procedure Call mechanism in Windows. ALPC

CVE-2026-83548 affects the SonicWall SMA1000 Appliance Work Place interface. The flaw is a pre-authentication server-side request forgery vulnerability. It is

CVE-2026-86060 affects MikroTik RouterOS. It is an argument-handling flaw. It exists in the SSH login path. The flaw involves usernames.

CVE-2026-83549 is a post-authentication OS command injection flaw in SonicWall SMA1000 Appliance Management Console. It is classified under CWE-78: Improper

JFrog Artifactory contains an authentication weakness. The vulnerability is tracked as CVE-2026-82329. It is mapped to CWE-287: Improper Authentication. Under

JFrog Artifactory (Self Hosted) before 7.133.11 contains an incorrect authorization flaw tracked as CVE-2026-42016. The issue is caused by a

CVE-2026-85046 is a type confusion vulnerability in Google Chrome’s V8 JavaScript engine. It affects Chrome versions before 152.0.7977.82. It also

CVE-2026-42018 is an improper authentication vulnerability in JFrog Artifactory. The flaw is tracked as CWE-287. It affects the anonymous-user token

CVE-2026-84869 affects the ConnectWise ScreenConnect client. A condition in the client may allow files to be transferred through an active

CVE-2026-75650 affects Adobe Commerce and Magento Open Source template processing. The weakness is CWE-1336, improper neutralization of special elements in

CVE-2025-25249 is a heap-based buffer overflow affecting Fortinet FortiOS and FortiSwitchManager. It is classified under CWE-122 and CWE-787. The flaw

CVE-2026-76461 affects Cisco AsyncOS Software for Cisco Secure Email Gateway. The flaw is in email parsing logic. Insufficient validation causes

CVE-2026-19490 affects NetScaler ADC and NetScaler Gateway. It is an authentication bypass using an alternate path or channel. The weakness

CVE-2026-67277 affects MikroTik RouterOS, specifically the btest bandwidth testing service. RouterOS accepts a “related” btest connection before the corresponding primary

CVE-2026-87491 is an out-of-bounds write vulnerability in Google Chrome’s V8 JavaScript engine. It affects Chrome versions prior to 153.0.8010.36. The

CVE-2026-20079 affects Cisco Secure Firewall Management Center (FMC) Software. It is an authentication bypass vulnerability in the web interface. The

ZITADEL is an open-source identity and access management platform that implements multi-tenant architecture through a concept called Project Grants, which

A critical authorization flaw exists in ZITADEL’s OAuth2 Token Exchange endpoint, specifically targeting the `urn:ietf:params:oauth:grant-type:token-exchange` grant type. This vulnerability allows

ESPHome Dashboard contains an authentication bypass vulnerability (CVE-2026-32711) stemming from a backward compatibility break introduced during an environment variable rename.

The image resizer in October CMS classified external sources by testing whether the source string began with the substring http,

The backend `SessionMaker` trait stored widget session state as `base64(serialize(…))` and consumed it with `unserialize()` without an `allowed_classes` restriction. Any

A vulnerability was identified in the Twig sandbox security policy that allowed a chained bypass when cms.safe_mode is enabled. The

CVE-2021-44228, known as Log4Shell, is a critical remote code execution vulnerability in Apache Log4j2, a widely used Java logging library.

CVE-2026-42018 is an improper authentication vulnerability (CWE-287) in JFrog Artifactory that allows a remote, unauthenticated attacker to obtain an internal

CVE-2026-42016 is a high-severity privilege escalation vulnerability affecting JFrog Artifactory Self Hosted deployments running versions prior to 7.133.11. The vulnerability

Open WebUI calendar events carry a free-form meta object. The meta object is stored exactly as submitted. No validation checks

The rclone `serve/start` RC endpoint accepts protocol options in a per-server `proxyOpt` object. The FTP and S3 RC adapters parse

In streamed multipart mode, rclone serve s3 passes the declared part length to multipart.NewRW().Reserve(contentLength) before reading part data. Reserve immediately

rclone serve s3’s handler chain, when –auth-proxy is configured, is (outermost first): authPairMiddleware -> proxyAuthMiddleware -> gofakes3’s own SigV4-verifying handler.

Open WebUI caches a user’s role in the Socket.IO session pool at connection time. The role is stored in an

The POST /v1/chat/completions endpoint in mistral.rs accepts unauthenticated requests. It fetches attacker-supplied media URLs for image, audio, and video content.

rclone core fails to sanitize parent-directory segments (..) in a source object’s `Remote()` value before that name is passed to

rclone serve ftp –auth-proxy uses a driver-global userPass map string keyed only by username. The FTP auth-proxy driver stores one

Open WebUI is an extensible, self-hosted AI platform. From version 0.8.0 until 0.11.1, the OAuth token exchange endpoint in `backend/open_webui/routers/auths.py`

The @jhb.software/payload-alt-text-plugin v0.7.0 registers custom Payload CMS endpoints. These endpoints are POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk. They call the Payload

rclone local backend uses -l/–links to recreate .rclonelink objects as real symlinks. This is preserved by design for faithful backups.

rclone is a command-line program used to sync files and directories to and from various cloud storage providers. A critical

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From version 0.6.41 until 0.11.1, the functions `get_user_by_oauth_sub` and

Traefik’s HTTP/3 request path fails to initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate (Kerberos) authentication

The rclone HTTP backend allows users to attach arbitrary secret headers to every request via the `–http-headers` flag or the

The OIDC back-channel logout endpoint accepts logout tokens from an identity provider. It is unauthenticated by design because the provider

The mistral.rs inference server, a Rust-based OpenAI-compatible platform, contains a critical vulnerability in its media loading logic within the `mistralrs-server-core`

Traefik v3 entrypoint defenses scan req.Header only. They never scan req.Trailer. aliasHeadersStrategy delete/reject is affected. underscoreHeadersStrategy delete/reject is affected. forwardedHeaders

Traefik accepts HTTP/1.x rootless/opaque request-targets such as GET http:http://internal-vhost/admin HTTP/1.1. Go parses this target with url.ParseRequestURI into URL.Opaque while URL.Path