•about 1 hour ago•CVE-2026-77301
7.5CVE-2026-77301: Uncontrolled Resource Allocation (Decompression Bomb) in adm-zip
CVE-2026-77301 is a critical uncontrolled resource allocation vulnerability in the popular Node.js library adm-zip (versions prior to 0.6.1). During ZIP decompression of asynchronous entries, the library trusts the uncompressed size metadata declared in the central directory headers. Because Node.js's streaming zlib API completely ignores the maxOutputLength configuration, a crafted ZIP archive (decompression bomb) causes the application to continually allocate resident memory buffers on the heap without limits, causing rapid memory exhaustion and a process-level Out-of-Memory (OOM) crash.
4 views•5 min read
•about 2 hours ago•CVE-2026-91127
8.2CVE-2026-91127: DOM Cross-Site Scripting via Unsafe Hyperlink Schemes in Flyfish File Viewer Legacy DOC Renderer
This report details CVE-2026-91127 (GHSA-3753-m2x2-q623), a high-severity DOM Cross-Site Scripting (DOM XSS) vulnerability in the file-viewer workspace developed by flyfish-dev. The legacy Word document (.doc) parser fails to restrict hyperlink URI schemes when rendering extracted document targets into generated HTML. As a result, a remote attacker can construct a malicious legacy DOC file containing scripts inside hyperlink properties. When a user previews the file and clicks the hyperlink, arbitrary JavaScript executes in the context of the hosting origin, enabling session hijacking, credential theft, or unauthorized API interaction.
4 views•7 min read
•about 3 hours ago•CVE-2026-63458
7.1CVE-2026-63458: Broken Object Level Authorization (BOLA) and Tenant Isolation Bypass in Perses
An authorization bypass and tenant isolation vulnerability in Perses prior to version 0.54.0-beta.3 allows authenticated viewers to access unauthorized project resources by manipulating query parameters or querying unmapped ephemeral endpoints.
6 views•6 min read
•about 4 hours ago•CVE-2026-63199
8.3CVE-2026-63199: Cross-Scope Secret Disclosure via Missing Authorization in Perses Datasource Proxy
CVE-2026-63199 is a critical missing authorization vulnerability (CWE-862) in Perses versions 0.43.0 to 0.54.0-rc.0. It allows low-privileged attackers to retrieve and exfiltrate highly sensitive credentials (secrets) from different scopes by configuring a malicious datasource pointing to an attacker-controlled endpoint.
6 views•7 min read
•about 5 hours ago•CVE-2026-63445
7.1CVE-2026-63445: Arbitrary File Read and Path Traversal in Perses File-System Database Backend
An arbitrary file read and path traversal vulnerability exists in Perses prior to version 0.54.0-rc.0. When configured with a file-system database backend, the application lacks input validation on the request-controlled project query parameter. An authenticated attacker with low privileges can supply directory traversal sequences to read arbitrary JSON or YAML files on the host file system.
6 views•6 min read
•about 6 hours ago•CVE-2026-59163
9.1CVE-2026-59163: Critical JWT Authentication Bypass in Mnemosyne Sync Server
CVE-2026-59163 is a critical authentication bypass vulnerability in the Mnemosyne sync server. In versions prior to v3.10.1, the server's authentication logic decoded incoming JSON Web Tokens (JWT) but completely skipped cryptographic signature verification. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, impersonate arbitrary users, read synchronized AI agent states, or write malicious database updates.
7 views•7 min read
•about 7 hours ago•CVE-2026-85058
7.5CVE-2026-85058: Missing Authorization in Moquette MQTT Broker Last Will and Testament Feature
An authorization bypass vulnerability exists in the Moquette MQTT broker prior to version 0.18.1. When an MQTT client registers a Last Will and Testament (LWT) topic during its connection setup, the broker fails to perform write-access checks on that topic. Upon an abrupt client disconnection, the broker publishes the registered Will message to subscribers of the unauthorized topic, bypassing configured Access Control Lists (ACLs).
5 views•8 min read
•about 8 hours ago•CVE-2026-71537
6.5CVE-2026-71537: Credit-Refund Double-Spend Race Condition in Paymenter Service Downgrade
A concurrent execution vulnerability (CWE-362) exists in the Paymenter webshop solution within the service downgrade execution path (doUpgrade). Authenticated customers can exploit this concurrency issue by sending concurrent HTTP requests to trigger multiple parallel executions of the refund process. Because the application checks for pending upgrades without database transactional isolation or exclusive row locks, attackers can generate multiple duplicate refunds to their account balance for a single downgrade action. This leads to arbitrary credit inflation on the platform.
6 views•9 min read
•about 9 hours ago•GHSA-XWMW-PRC4-V3CR
8.8GHSA-XWMW-PRC4-V3CR: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in Obot Platform
A critical security vulnerability exists in the Obot Platform (versions < 0.23.0) where unauthenticated OAuth dynamic client registration, a consentless authorization flow, and a lack of JWT audience validation enable remote attackers to steal API tokens via audience confusion.
8 views•6 min read
•about 10 hours ago•GHSA-PR6H-VR44-XQ8J
5.3GHSA-PR6H-VR44-XQ8J: Authentication Bypass in Obot Model Context Protocol (MCP) Registry API
An authentication bypass vulnerability in Obot versions <= v0.22.1 allows unauthenticated remote attackers to access Model Context Protocol (MCP) registry metadata and retrieve server lists when OBOT_SERVER_ENABLE_REGISTRY_AUTH is configured. This is due to a routing logic flaw where `/v0.1` paths are incorrectly categorized as public frontend user interface assets.
7 views•8 min read
•about 15 hours ago•GHSA-JGH3-FGGC-MCPM
7.6GHSA-jgh3-fggc-mcpm: Non-Blind Server-Side Request Forgery (SSRF) in Obot Platform
An authenticated Server-Side Request Forgery (SSRF) vulnerability in the Obot Platform allows administrative or power users to bypass IP verification and scan or query internal resources, private networks, and cloud instance metadata services (IMDS). Because response bodies and error details are reflected back to the client interface, this constitutes a non-blind SSRF.
10 views•8 min read
•about 16 hours ago•GHSA-JR78-W6W5-M8F8
7.3GHSA-JR78-W6W5-M8F8: Missing Authorization in Semantic MediaWiki smwtask API Module Allows Unauthenticated Administrative Actions
Semantic MediaWiki starting from version 3.0.0 up to and including 7.2.1 is vulnerable to an unauthenticated missing authorization flaw in its `smwtask` API module. The endpoint fails to execute permission or privilege checks on callers. Instead, it relies on a CSRF token check, which can be satisfied by anonymous users using MediaWiki's static public CSRF token. Remote, unauthenticated attackers can exploit this flaw to retrieve internal database statistics, enqueue background jobs, run database queries, or trigger entity disposal processes, potentially leading to information disclosure, database corruption, and Denial of Service.
12 views•6 min read