•about 4 hours ago•GHSA-9Q4R-4842-93VW
7.7GHSA-9Q4R-4842-93VW: Cross-Tenant SQL Injection in Trigger.dev TSQL Query Compiler
A critical cross-tenant SQL injection vulnerability exists in the TSQL query compiler of Trigger.dev, allowing authenticated users to bypass tenant isolation boundaries and read arbitrary ClickHouse analytics logs and execution payloads belonging to other organizations.
5 views•6 min read
•about 5 hours ago•GHSA-4672-HWV6-GQ62
5.4GHSA-4672-HWV6-GQ62: Cross-environment deployment cancellation in Trigger.dev
A logical authorization bypass vulnerability exists in Trigger.dev versions prior to 4.5.6. This flaw allows an authenticated client with a low-trust environment API key, such as development or staging, to cancel active worker deployments in a higher-trust environment like production within the same project. The vulnerability occurs because write operations on deployments were scoped solely by project identifier instead of environment identifier.
4 views•6 min read
•about 6 hours ago•GHSA-JQMF-MX4F-HFR6
10.0GHSA-JQMF-MX4F-HFR6: Multiple Remote Code Execution and Security Flaws in Vibe-Trading AI-Agent Pipeline
An in-depth technical analysis of multiple critical security flaws identified in the Vibe-Trading ecosystem (vibe-trading-ai). These issues range from unauthenticated remote command injection via agent tool executions to arbitrary Python execution through dynamic module loading and unsafe Jinja2 template autoescaping, allowing full system compromise.
5 views•7 min read
•about 7 hours ago•GHSA-5RMQ-CHC7-M22F
7.5GHSA-5RMQ-CHC7-M22F: Arbitrary File Read and Path Traversal in Vibe-Trading Platform
An arbitrary file read and path traversal vulnerability in the Vibe-Trading platform allows unauthenticated remote attackers to retrieve sensitive configuration files, API keys, and system secrets. The flaw stems from permissive directory checking in path validation tools and a complete lack of input sanitization in the document reader utility. Remediation was introduced in version 0.1.7 by implementing strict path allowlists, forcing user authentication, and dropping root execution privileges within the container environment.
5 views•6 min read
•about 8 hours ago•GHSA-V2F8-6655-7GRJ
10.0GHSA-v2f8-6655-7grj: Remote Code Execution and Authentication Bypass in vibe-trading-ai
The vibe-trading-ai package prior to version 0.1.7 contains multiple critical security vulnerabilities including unauthenticated remote code execution (RCE) via session message injection, missing authentication on read endpoints, unrestricted file upload, insecure CORS policies, and sensitive key disclosure. Because the application default settings failed open, ran as root within Docker, and bound to all interfaces, remote unauthenticated attackers could compromise host environments containing sensitive trading data.
6 views•6 min read
•about 9 hours ago•CVE-2026-18140
7.5CVE-2026-18140: Uncontrolled Recursion in aws-smithy-json Token Skipping Path
CVE-2026-18140 is a denial-of-service vulnerability in the Amazon aws-smithy-json Rust crate. Under-validation of recursion depth within the unknown-key skipping path allows a remote, unauthenticated attacker to cause stack exhaustion and process aborts by sending deeply nested JSON arrays.
5 views•6 min read
•about 10 hours ago•GHSA-FJ2X-MQQP-3V2W
7.5GHSA-FJ2X-MQQP-3V2W: Sensitive Information Disclosure in Trigger.dev CLI Build Logs
A sensitive information disclosure vulnerability exists in the Trigger.dev Command Line Interface (CLI) framework. When executing build processes inside CLI v3 packages, the framework's debug deployment logs print unredacted, resolved environment variables and secrets to standard output or log streams. This exposure occurs when the CLI is operated with a high logging verbosity level, enabling any individual or automated system with read access to build logs, CI/CD output consoles, or local development streams to capture plaintext sensitive parameters, such as database credentials, API keys, and private external integration tokens.
5 views•6 min read
•about 11 hours ago•CVE-2026-104855
2.0CVE-2026-104855: Sandbox Escape via Reentrant State Desynchronization in Wasmtime Bulk Memory Operations
CVE-2026-104855 is a critical vulnerability involving a race condition and reentrant state desynchronization within Wasmtime, a standalone WebAssembly runtime. Due to incremental mid-operation preemption points in compiler-generated loops for bulk memory and table operations, a host-defined epoch or fuel deadline callback could mutate the WebAssembly Store. Upon resuming, the virtual machine utilized stale cached pointers, resulting in use-after-free, out-of-bounds writes, and sandbox escape.
4 views•7 min read
•about 12 hours ago•CVE-2026-74802
8.2CVE-2026-74802: Cross-Site WebSocket Hijacking (CSWSH) in SiYuan Knowledge Workspace
CVE-2026-74802 is a critical Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the SiYuan knowledge workspace application. Due to improper origin validation across multiple internal WebSocket endpoints, an attacker can hijack active authenticated sessions when a victim visits an untrusted external page. This allows the attacker to route malicious network traffic through the victim's localized SiYuan server, establishing an authenticated network pivot and facilitating Server-Side Request Forgery (SSRF).
5 views•5 min read
•about 13 hours ago•CVE-2026-74904
8.7CVE-2026-74904: Missing Authorization in SiYuan Note-Taking Application API
A high-severity missing authorization vulnerability (CWE-862) exists in the SiYuan note-taking application before v3.7.4. Seventeen block metadata and content-derived endpoints within kernel/api/block.go lack proper publish-access and role-based checks. This allows low-privilege or anonymous users in publish mode to bypass workspace restrictions and disclose private block content, trace workspace structures, map document indexes, and verify the existence of private notes. The vulnerability is addressed in version v3.7.4.
5 views•6 min read
•about 14 hours ago•CVE-2026-71416
8.8CVE-2026-71416: Cross-Site WebSocket Hijacking in Headroom Proxy Server
A critical cross-site WebSocket hijacking (CSWSH) vulnerability in headroomlabs-ai/headroom prior to version 0.35.0 allows unauthorized external origins to establish connection channels to the Headroom proxy, enabling arbitrary prompt execution and remote code execution through local tool integration.
6 views•6 min read
•about 15 hours ago•GHSA-CJCG-CXMH-9WCR
7.5GHSA-cjcg-cxmh-9wcr: Unbounded Memory Allocation via HTTP/2 Bomb in praxis-proxy
A critical vulnerability exists in the praxis-proxy library where the omission of default limits on HTTP/2 server options allows remote attackers to trigger a Denial of Service (DoS) using an HPACK compression bomb and flow-control window stalls. This vulnerability is cataloged as GHSA-cjcg-cxmh-9wcr.
5 views•7 min read