A critical sandbox escape vulnerability in JSONata versions prior to 1.8.8 and 2.2.1 allows unauthenticated remote attackers to execute arbitrary code on the host machine. By submitting crafted JSONata expressions, an attacker can manipulate internal AST structures, bypass object clone helpers, spoof native function flags, and escape the evaluation environment to execute system commands through the Node.js runtime.
CVE-2026-77414 (GHSA-2943-5xfg-gq5f) is a critical sandbox escape and remote code execution vulnerability in the JSONata package. When JSONata processes untrusted expressions, it uses a vulnerable environment lookup check that can be shadowed by user-defined variables. Attackers can leverage this to traverse the prototype chain, reach the global Function constructor, and execute arbitrary system commands on the host machine.
An overly permissive default configuration in the Grav CMS Twig sandbox combined with a lack of neutralization of double-quote characters in the Asset rendering engine allows low-privileged page editors to inject malicious JavaScript into administrative contexts. This leads to a stored cross-site scripting (XSS) condition that compromises the sessions of super-administrators, facilitating complete privilege escalation.
An authenticated Twig sandbox escape vulnerability in Winter CMS allows users with template-editing privileges to bypass sandbox restrictions and execute arbitrary PHP code. This vulnerability represents a complete bypass of the sandbox protections introduced by the previous patch for CVE-2024-54149.
A missing authorization vulnerability in Fleet device management software allows unauthenticated remote attackers to access proprietary enterprise iOS packages (.ipa) and manifest configurations by scanning predictable integer identifiers.
A relative path traversal vulnerability (CWE-23) in the client-side sftp utility of OpenSSH before version 10.4 allows malicious or compromised SFTP servers to write or overwrite files outside the intended destination directory when a user executes a direct one-shot download command.
A SQL injection vulnerability exists in the activity list endpoints of Fleet Device Management. Authenticated users can manipulate the order_key parameter to sort database queries by arbitrary columns, including columns not projected in the SELECT query. This flaw allows attackers to establish an inference oracle to extract sensitive information from the database.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Backend List widget of Winter CMS (winter/wn-backend-module). When a list column is configured with the 'image' type and displays attacker-controlled input, the lack of sanitization in the image URL allows injection of arbitrary HTML attributes, potentially executing malicious scripts in the session of administrators viewing the list.
An Insecure Direct Object Reference (IDOR) vulnerability was identified in Winter CMS version 1.2.13. The vulnerability exists within the newly introduced Backend\Controllers\MyAccount controller, which utilizes the FormController behavior without appropriate model query scoping or routing controls. This allows authenticated, low-privilege backend users to retrieve sensitive personal and administrative data of other backend accounts by enumerating record identifiers via standard CRUD routes.
Winter CMS contains an authorization bypass vulnerability within its ImportExportController behavior. Due to a design flaw in the request lifecycle processing, permissions configured for data import and export operations are not validated during AJAX-based requests, allowing authenticated users with limited privileges to perform unauthorized data exfiltration or database manipulation.
Winter CMS versions prior to 1.2.14 are vulnerable to Stored Cross-Site Scripting (XSS) within the administrative backend interface. The flaw resides in the custom styles rendering pipeline for Brand Settings and Editor Settings. An attacker with privileges to modify backend branding or editor configurations can inject arbitrary JavaScript, which is written to the cache without sanitization. Subsequent page requests that result in a cache hit completely bypass output sanitization filters, leading to JavaScript execution in the sessions of other administrative users.
Winter CMS contains a routing bypass vulnerability that allows Cross-Site Request Forgery (CSRF) attacks to trigger administrative AJAX handlers. Due to case-insensitivity in PHP's method resolution and an insufficiently strict check in the backend controller system, an attacker can invoke these handler methods through lowercase HTTP GET requests, bypassing default CSRF token validation.
Or generate a custom report
Search for a CVE ID (e.g. CVE-2024-1234) to generate an AI-powered vulnerability analysis
Automated vulnerability intelligence. 2,520+ reports.