Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload

GHSA-w7mq-r738-x278 CVE-2026-54352 CRITICAL about 2 months ago

## Summary `POST /api/pwa/process-zip` at `packages/server/src/api/routes/static.ts:24` accepts a builder-uploaded `.zip`, extracts it with `extra...

npm

No PRs yet

Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

GHSA-rgvg-3wpc-h44p CVE-2026-54351 HIGH about 2 months ago

## Summary The webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution paramet...

npm

No PRs yet

@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens

GHSA-cq9c-6w48-qmfg CVE-2026-49229 HIGH about 2 months ago

### Summary In OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity. Existing Actual session tokens for the ...

npm

No PRs yet

Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials

GHSA-35c4-rvc8-frhm CVE-2026-50137 HIGH about 2 months ago

## Summary The Budibase server route `POST /api/attachments/:datasourceId/url` ([`packages/server/src/api/routes/static.ts`](https://github.com/Bu...

npm

No PRs yet

Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

GHSA-jj36-r9w3-3pfh CVE-2026-50136 HIGH about 2 months ago

The application server exposes an unauthenticated endpoint that generates S3 `PutObject` presigned URLs using credentials stored in a workspace dat...

npm

No PRs yet

Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF

GHSA-v7j5-vc4m-723w CVE-2026-50132 HIGH about 2 months ago

## Title **Chat Identity Link Hijacking — Attacker Can Silently Map Their Slack/Discord Identity to Any Authenticated Budibase User's Account** #...

npm

No PRs yet

zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet

GHSA-qc2x-6f54-m6h9 CVE-2026-48487 MODERATE about 2 months ago

### Impact `_read_character_string` and `_read_string` in `src/zeroconf/_protocol/incoming.py` sliced `self.data[self.offset : self.offset + lengt...

pypi

1

Dependabot PRs

devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs

GHSA-hvqh-jw65-wcpq MODERATE about 2 months ago

### Summary The default `formatGroup` and `formatResult` functions in `devbridge-autocomplete` concatenate values into HTML without escaping, allo...

npm

No PRs yet

scimPatch vulnerable to prototype pollution via unfiltered keys in patch

GHSA-9m6g-wc8r-q59c CVE-2026-48170 CRITICAL about 2 months ago

## Summary `scim-patch` performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.som...

npm

No PRs yet

nebula-mesh's stores enrollment tokens unhashed in SQLite

GHSA-ghmh-jhmj-wcmf MODERATE about 2 months ago

`internal/store/sqlite.go:1177,1192,1221,1245` — the `enrollment_tokens.token` column holds the raw UUID token. `ConsumeToken` does `WHERE token = ...

go

No PRs yet

Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata

GHSA-4q6h-8p4v-67vq CVE-2026-48153 HIGH about 2 months ago

## Summary `fetchToken` in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipping the `blacklist.isBlacklisted` che...

npm

No PRs yet

skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery

GHSA-74p7-6h78-gw8p HIGH about 2 months ago

## Impact Following the path-safety patches in [GHSA-wx3m-whqv-xv47](https://github.com/umanio-agency/skillctl/security/advisories/GHSA-wx3m-whqv-...

cargo

No PRs yet

Gogs has SSRF in webhook deliveries

GHSA-c4v7-xg93-qf8g CVE-2026-47267 HIGH about 2 months ago

### Summary The fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolves in localCIDRs. However, ...

go

No PRs yet

@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

GHSA-3f62-qv96-4p78 CVE-2026-46700 MODERATE about 2 months ago

## Summary In `@actual-app/sync-server`, the `GET /secret/:name` endpoint (`app-secrets.js:53`) checks only that the caller has a valid session — ...

npm

No PRs yet

@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper

GHSA-7gh7-258j-4mpq CVE-2026-46672 MODERATE about 2 months ago

## Summary `@actual-app/cli` ships a hand-rolled CSV serializer in `packages/cli/src/output.ts` (used whenever the global `--format csv` option is...

npm

No PRs yet

Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack

GHSA-w856-8p3r-p338 CVE-2026-46611 MODERATE about 2 months ago

### Summary The Glances XML-RPC server (`glances -s`, implemented in `glances/server.py`) does not validate the HTTP `Host` header, leaving it vul...

pypi

No PRs yet

Gophish contains a denial of service vulnerability

GHSA-42jc-v69j-g38f CVE-2026-39904 HIGH about 2 months ago

Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by up...

go

No PRs yet

Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

GHSA-87qc-fj39-wccr CVE-2026-46608 HIGH about 2 months ago

### Summary The Glances XML-RPC server (`glances -s`) introduced a configurable CORS origin list in version 4.5.3 as a mitigation for CVE 2026-335...

pypi

No PRs yet

Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution

GHSA-9837-48hr-q32j CVE-2026-46607 HIGH about 2 months ago

### Summary `glances/outdated.py` uses `pickle.load()` to read a version-check cache file stored at a predictable, world-accessible path (`~/.cach...

pypi

No PRs yet

Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

GHSA-v5r2-qh84-fjx5 CVE-2026-46606 HIGH about 2 months ago

### Summary The Glances KVM/QEMU monitoring engine (`glances/plugins/vms/engines/virsh.py`) passes VM domain names, read directly from `virsh list...

pypi

No PRs yet

OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

GHSA-43x2-g84q-fmqx CVE-2026-46495 CRITICAL about 2 months ago

## Summary **Description** A Deserialization of Untrusted Data (CWE-502) issue in OpenDJ's JMX RMI connector allows an unauthenticated remote att...

maven

No PRs yet

motionEye: Authentication possible via password hash

GHSA-r3cw-c95m-wfh9 CVE-2026-46488 CRITICAL about 2 months ago

### Summary An authentication bypass vulnerability exists due to improper trust in client-controlled cookies. The application accepts user-supplied...

pypi

No PRs yet

Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types

GHSA-c8q4-9h32-2ww8 CVE-2026-44795 HIGH about 2 months ago

### Impact There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing: * CloudForm...

maven

No PRs yet

OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`

GHSA-fhrq-3gmx-p879 CVE-2026-44793 LOW about 2 months ago

## Summary Certain federation endpoints do not consistently apply output encoding when rendering user-supplied parameters into HTML responses. Und...

maven

No PRs yet

Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF (no shipped gadget affected)

GHSA-7cfq-5mhv-jrp9 CVE-2026-44778 LOW about 2 months ago

## Summary A malicious container can crash or destabilize the privileged Inspektor Gadget process when a **gadget using USDT probes** is deployed....

go

No PRs yet

Paymenter has broken object level authorization via service reference manipulation on ticket creation

GHSA-x93q-x9pc-w5hw CVE-2026-44585 MODERATE about 2 months ago

### Summary The ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated ...

packagist

No PRs yet

Paymenter doesn't reset email verification status after email change

GHSA-rv89-wch8-c574 CVE-2026-44584 MODERATE about 2 months ago

### Summary The email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a ...

packagist

No PRs yet

Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module

GHSA-7wwh-xcc3-9fcg CVE-2026-44583 MODERATE about 2 months ago

### Summary The PayPal webhook endpoint `/extensions/paypal/webhook` processes the `PAYPAL-CERT-URL` HTTP header without validation, allowing attac...

packagist

No PRs yet

Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

GHSA-49p4-px3h-rq49 CVE-2026-44517 MODERATE about 2 months ago

### Impact When processing a build contexts or `add`/`copy` instructions, a malicious server serving a Git repository or a tar archive file can ca...

go

No PRs yet

OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

GHSA-fq9h-c788-fx73 CVE-2026-44203 CRITICAL about 2 months ago

### Summary The OAuth 2.0 / OpenID Connect authorization endpoint does not sufficiently sanitize certain user-supplied parameters before incorpora...

maven

No PRs yet

OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

GHSA-c556-q2mh-477v CVE-2026-44202 MODERATE about 2 months ago

OpenAM (Open Identity Platform) is an open-source Identity and Access Management (IAM) platform derived from ForgeRock OpenAM, providing SSO, OAuth...

maven

No PRs yet

xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro

GHSA-w56x-9778-rppx CVE-2026-44179 CRITICAL about 2 months ago

### Summary The excerpt-include macro does not properly escape the title of the included page and executes the content of the excerpt with the macr...

maven

No PRs yet

runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

GHSA-xjvp-4fhw-gc47 CVE-2026-41579 MODERATE about 2 months ago

### Impact When setting up the container rootfs, `setupPtmx` and `setupDevSymlinks` call `os.Remove` and `os.Symlink` with a `filepath.Join` string...

go

1

Dependabot PRs

OpenAM has LDAP Injection via `_queryId` Parameter

GHSA-2vg8-q4c2-5cw3 CVE-2026-41573 HIGH about 2 months ago

OpenAM (Open Identity Platform) is an open-source IAM platform providing SSO, OAuth2, SAML, and OpenID Connect capabilities. The CREST REST API lay...

maven

No PRs yet

AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data

GHSA-95jh-7r58-xmxw CVE-2026-33731 MODERATE about 2 months ago

## Summary The Authorize.Net webhook handler at `plugin/AuthorizeNet/webhook.php` contains a signature verification bypass that allows an attacker...

packagist

No PRs yet

ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

GHSA-95pq-hr8p-f5g7 CVE-2025-67303 HIGH about 2 months ago

### Impact An **Unprotected Alternate Channel (CWE-420)** vulnerability was discovered in ComfyUI-Manager versions prior to 3.38. #### Vulnerabil...

pypi

No PRs yet

AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration

GHSA-wf69-r4mx-43rr CVE-2026-33692 HIGH about 2 months ago

## Vulnerability Details **CWE**: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory The official `docker-...

packagist

No PRs yet

Keras: DiskIOStore permits path traversal through crafted layer names

GHSA-gh82-f9x8-5frx CVE-2026-12479 MODERATE about 2 months ago

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method within the Keras 3 model sa...

pypi

No PRs yet

AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions

GHSA-8j8m-p79x-g4jm CVE-2026-33684 MODERATE about 2 months ago

## Summary The `set_api_signUp` method in the API plugin accepts `emailVerified`, `canUpload`, `canStream`, and `canCreateMeet` parameters from us...

packagist

No PRs yet

Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)

GHSA-fjj5-v948-whjj CVE-2026-33646 CRITICAL about 2 months ago

## Summary Mise processes `.tool-versions` files through the Tera template engine during parsing, with the `exec()` function registered, enabling ...

cargo

No PRs yet

motionEye's World-Readable Configuration File Exposes Admin Password Hash

GHSA-rhgp-6wq6-9j67 CVE-2026-32315 MODERATE about 2 months ago

# Security Advisory: World-Readable Configuration File Exposes Admin Password Hash in motionEye ## Summary motionEye v0.43.1 and prior versions c...

pypi

No PRs yet

motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint

GHSA-g9fx-5r4h-pcw3 CVE-2026-31978 MODERATE about 2 months ago

### Summary motionEye v0.43.1 (latest stable) is vulnerable to path traversal in the picture and movie API endpoints, like `/picture/{id}/preview/...

pypi

No PRs yet

Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers

GHSA-w6j9-vw59-27wv CVE-2026-25119 HIGH about 2 months ago

## Summary When `ENABLE_REVERSE_PROXY_AUTHENTICATION` is enabled, Gogs accepts the configured authentication header (default: `X-WEBAUTH-USER`) di...

go

No PRs yet

OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature

GHSA-ffm6-vvph-g5f5 CVE-2026-21887 HIGH about 2 months ago

### Summary The OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its def...

pypi

No PRs yet

Gogs has a Denial of Service in repository/wiki file listing web pages

GHSA-3qq3-668m-v9mj CVE-2025-64719 MODERATE about 2 months ago

### Summary A malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the p...

go

No PRs yet

Paymenter vulnerable to Remote Code Execution via public file uploads

GHSA-5pm9-r2m8-rcmj CVE-2025-58048 CRITICAL about 2 months ago

### Impact The ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. With the ability to...

packagist

No PRs yet

OpenCTI May Bypass Introspection Restriction

GHSA-4mvw-j8r9-xcgc CVE-2024-37155 MODERATE about 2 months ago

### Summary The regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line...

pypi

No PRs yet

Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for the statsite protocol, which is a variant of statsd. Newlines are not removed from metric names, allowing metric injections. Values ...

CPANSA-Net-Statsite-Client-2026-11373 CVE-2026-11373 about 2 months ago

Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for the statsite protocol, which ...

cpan

No PRs yet

Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving n...

CPANSA-Crypt-OpenSSL-PKCS12-2026-9265 CVE-2026-9265 about 2 months ago

Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8ST...

cpan

No PRs yet

Anki's local HTTP server does not sufficiently validate requests

GHSA-869j-r97x-hx2g CVE-2026-59153 HIGH about 2 months ago

## Summary Anki launches a local HTTP server to serve media files and web pages for parts of its interface. While the server has a CORS setup, req...

pypi

No PRs yet