•about 2 hours ago•CVE-2026-53951
8.8CVE-2026-53951: Trust-Prefix Bypass via Path Traversal leading to Remote Code Execution in Copier
A security vulnerability in Copier versions 9.5.0 through 9.15.1 allows unauthenticated remote code execution via crafted HTTP requests or local paths containing traversal sequences. The trust-evaluation mechanism compares target repository paths or URLs against trusted prefixes using unnormalized string comparison, while the subsequent fetching mechanism normalizes the path before cloning. Attackers can exploit this asymmetry to bypass security warning prompts and execute arbitrary commands under the local user context.
2 views•6 min read
•about 3 hours ago•GHSA-P77J-G7H5-R2VW
8.8GHSA-P77J-G7H5-R2VW: Tier-0 Security Hardening in GeoLens
GeoLens before version 1.2.4 contains multiple critical-tier security vulnerabilities including improper authorization in metadata access, tile cache scope leakage, dataset title enumeration, weak default credentials, and denial of service via STAC POST search.
3 views•6 min read
•about 4 hours ago•CVE-2026-55694
7.1CVE-2026-55694: Chained Information Disclosure and IDOR in Snipe-IT EULA Management
CVE-2026-55694 is a chained Information Disclosure and Insecure Direct Object Reference (IDOR) vulnerability in Snipe-IT prior to version 8.6.3. The vulnerability allows authenticated, restricted users to completely bypass randomized file-naming security controls, leak the obfuscated filenames of signed End User License Agreements (EULAs), and subsequently download these confidential documents across tenant boundaries.
4 views•7 min read
•about 5 hours ago•CVE-2026-55703
4.3CVE-2026-55703: Missing Authorization in Snipe-IT Maintenance Records
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.
4 views•5 min read
•about 6 hours ago•CVE-2026-61807
6.3CVE-2026-61807: Stored DOM-Based Cross-Site Scripting in Snipe-IT
A Stored DOM-based Cross-Site Scripting (DOM XSS) vulnerability exists in Snipe-IT versions prior to 8.6.2. The vulnerability occurs when a stored manufacturer or supplier name is converted to CamelCase and rendered within the 'data-selected-count-id' attribute of a table. Client-side JavaScript retrieves this decoded attribute and performs unsafe string concatenation, passing it directly into jQuery's '.after()' method, enabling authenticated attackers to execute arbitrary JavaScript in the victim's session.
3 views•6 min read
•about 7 hours ago•CVE-2026-62673
8.2CVE-2026-62673: Security Bypass in Grav CMS via Case-Sensitivity Mismatch
CVE-2026-62673 (also known as CVE-2026-62230 and GHSA-vwg3-w8w3-pc79) is a high-severity security bypass vulnerability in the Grav CMS. It permits unauthenticated remote attackers to circumvent directory and file access policies defined in Apache .htaccess. This flaw allows direct retrieval of sensitive configuration files, system-level credentials, and database equivalents from case-insensitive host filesystems.
4 views•6 min read
•about 8 hours ago•GHSA-HJWH-XVFW-QRWJ
5.5GHSA-HJWH-XVFW-QRWJ: Credential Disclosure via Diagnostic Boundaries in mcp-searxng
A credential disclosure vulnerability in the mcp-searxng NPM package prior to version 1.12.0 allows attackers to recover plain-text SearXNG Basic Authentication credentials. The application exposes these credentials via console logs (stderr), MCP logging notifications, validation error messages, and JSON-RPC error responses. This occurs because the application lacks comprehensive sanitization across diagnostic boundaries when credentials are parsed from the SEARXNG_URL environment variable.
2 views•6 min read
•about 10 hours ago•CVE-2026-61711
5.3CVE-2026-61711: Sandbox Escape via Protobuf SecurityMode Enum Validation Bypass in Moby BuildKit
A detailed technical analysis of CVE-2026-61711, an input validation flaw in Moby BuildKit prior to version 0.31.1. The flaw allows unauthorized or custom frontends to construct build execution environments where Seccomp and AppArmor configurations are completely disabled by supplying an invalid protobuf enum index, resulting in an elevated kernel-level attack surface inside the build sandbox.
5 views•4 min read
•about 11 hours ago•CVE-2026-61712
2.3CVE-2026-61712: Denial of Service via Unbounded Resource Allocation in moby/buildkit
moby/buildkit is susceptible to a denial-of-service vulnerability prior to version 0.31.1. When BuildKit processes user or group directives from untrusted build contexts or base images, it reads configuration databases such as /etc/passwd and /etc/group directly into memory without enforcing boundaries. An attacker can exploit this behavior by engineering malicious files that trigger host memory exhaustion or block daemon threads indefinitely.
3 views•7 min read
•about 12 hours ago•CVE-2026-59992
5.4CVE-2026-59992: Broken Access Control and Path Traversal in Tina CMS Production Media Adapters
CVE-2026-59992 is a critical broken access control vulnerability in the first-party production media adapters of Tina CMS, including next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, and next-tinacms-cloudinary. The issue allows authenticated editors to escape the configured mediaRoot directory containment, facilitating unauthorized file uploads, modifications, and deletions across the entire storage bucket or container.
2 views•6 min read
•about 13 hours ago•CVE-2026-63123
6.5CVE-2026-63123: Cross-Site Request Forgery leading to Cross-Origin Arbitrary File Write in @tinacms/cli
A Cross-Site Request Forgery (CSRF) vulnerability in the local development server of @tinacms/cli allowed malicious cross-origin pages to send state-changing HTTP requests. This issue permitted attackers to write arbitrary files into a developer's project directory or manipulate search and GraphQL indices without authorization.
5 views•4 min read
•about 14 hours ago•CVE-2026-63188
8.7CVE-2026-63188: Unauthenticated Directory Traversal in @logto/tunnel
A high-severity path traversal vulnerability exists in the @logto/tunnel npm package (part of the Logto repository) prior to version 0.3.9. Remote unauthenticated attackers can exploit this vulnerability to read arbitrary local files by sending crafted HTTP requests with directory traversal sequences when the static file proxy is active.
5 views•7 min read