•about 10 hours ago•CVE-2026-63462
7.5CVE-2026-63462: Unauthenticated Stack Overflow Denial of Service in Unleash Server
An unauthenticated remote denial of service vulnerability exists in the Unleash feature management platform. By submitting a crafted JSON payload containing deeply nested structures to an OpenAPI-validated endpoint, an attacker can trigger uncontrolled recursion within the error formatting module. This leads to a call-stack exhaustion (RangeError: Maximum call stack size exceeded) inside the Node.js runtime, causing the service to crash immediately without recovery.
7 views•6 min read
•about 11 hours ago•CVE-2026-63004
5.5CVE-2026-63004: Server-Side Request Forgery in Unleash Addon and Integration Subsystem
CVE-2026-63004 is a server-side request forgery (SSRF) vulnerability in the Unleash feature management platform. Authenticated administrators with CREATE_ADDON or UPDATE_ADDON privileges can exploit this vulnerability to initiate requests to loopback addresses, private networks, and cloud metadata endpoints, potentially leading to information disclosure and credential extraction.
7 views•8 min read
•about 12 hours ago•CVE-2026-63466
4.1CVE-2026-63466: Process-Wide Security Degradation via Global Module Mutation in Unleash
Prior to version 8.0.3, Unleash's Markdown event formatter directly mutated the global template-escaping function of the shared mustache Node.js module, resulting in a process-wide security degradation where HTML/Markdown escaping was permanently disabled for the application lifetime.
3 views•6 min read
•about 13 hours ago•CVE-2026-76904
9.8CVE-2026-76904: Unauthenticated SQL Injection in GeoTools PostGIS DataStore Component
A critical SQL injection vulnerability exists in the GeoTools open-source Java library. This vulnerability is situated within the post-processing phase of OGC Filter conversion inside the PostGIS DataStore module. Specifically, the `jsonArrayContains` function does not validate or sanitize its arguments before constructing PostgreSQL SQL/JSON path evaluation queries. An unauthenticated remote attacker can exploit this weakness by submitting crafted filters via standard OGC services like WFS or WMS to execute arbitrary SQL commands on the underlying database system.
6 views•5 min read
•about 14 hours ago•CVE-2026-61824
8.2CVE-2026-61824: High-Severity Cross-Site Scripting (XSS) via Unsanitized Site Extractors in Defuddle
CVE-2026-61824 is a high-severity Cross-Site Scripting (XSS) vulnerability in kepano/defuddle before version 0.19.1. Custom site extractors for platforms such as X/Twitter, Substack, and YouTube constructed HTML representations via template string interpolation without output escaping. This allowed malicious pages to bypass standard parser sanitization routines and execute arbitrary JavaScript.
5 views•7 min read
•about 15 hours ago•CVE-2026-63421
7.5CVE-2026-63421: Query Limit Bypass via Negative Integer Input in KeystoneJS core resolvers
A high-severity vulnerability exists in KeystoneJS, a popular Node.js CMS and GraphQL framework, where the query resolution engine fails to validate signed negative integers within the pagination subsystem. Unauthenticated remote attackers can leverage this flaw to bypass the 'graphql.maxTake' safety boundary. By sending large negative values in the 'take' query parameter, the underlying Prisma ORM interprets the value as an instruction to fetch rows from the end of the collection, allowing malicious actors to bypass pagination limits, trigger database resource exhaustion, and execute application-level Denial of Service (DoS) attacks.
5 views•6 min read
•about 16 hours ago•CVE-2026-64679
8.1CVE-2026-64679: Directory Traversal via Workspace Parameter in Atlantis
A critical path traversal vulnerability in Atlantis allows authenticated users or repository contributors to execute directory operations outside of the repository directory boundary via crafted workspace parameters in configuration files or API requests.
9 views•6 min read
•about 17 hours ago•CVE-2026-76905
7.5CVE-2026-76905: Denial of Service via Nil-Pointer Dereference in getkin/kin-openapi openapi3filter
CVE-2026-76905 is a high-severity Denial of Service (DoS) vulnerability in the getkin/kin-openapi library, specifically inside the openapi3filter sub-package. When processing multipart/form-data request validation errors, a missing nil-pointer guard causes a Go runtime panic during error formatting. This panic terminates the active server process if no recovery handler is present, resulting in a total denial of service. The vulnerability affects versions from v0.10.0 to v0.140.0, and is resolved in v0.141.0.
9 views•6 min read
•about 18 hours ago•CVE-2026-59989
9.2CVE-2026-59989: Remote Code Execution via Server-Side Template Injection in Phalcon Volt Engine
A critical server-side template injection (SSTI) vulnerability exists in the Volt template engine of the Phalcon PHP framework. In versions 5.15.0 and earlier, raw AST token values for filter arguments in the 'join' filter are directly spliced into the generated PHP template code. This allows an attacker who can influence Volt templates to execute arbitrary PHP code during template rendering.
5 views•5 min read
•about 19 hours ago•CVE-2026-61539
10.0CVE-2026-61539: Remote Code Execution via Llama3 Tool Parser Eval Injection in Xinference
CVE-2026-61539 is a critical remote code execution vulnerability in Xinference, an inference API framework for open-source LLMs. In version 2.5.0 and earlier, model-generated outputs representing Llama3 tool calls are passed directly to Python's built-in eval() function inside the parser components. By manipulating conversational input or injecting instructions, an attacker can influence the LLM to output a Python expression containing malicious system commands, resulting in unauthenticated remote code execution on the host. This vulnerability has been resolved in Xinference version 2.7.0.
6 views•6 min read
•about 20 hours ago•CVE-2026-77354
8.7CVE-2026-77354: Uncontrolled Resource Consumption (OOM) via Sparse Array Indexes in kin-openapi
An uncontrolled resource consumption vulnerability (CWE-400/CWE-789) exists within the kin-openapi Go library prior to version 0.142.0. The vulnerability occurs during the processing of highly sparse array indexes inside query parameters defined in deepObject style. An unauthenticated remote attacker can exploit this flaw to cause an immediate Out-of-Memory (OOM) crash of the target application.
7 views•8 min read
•about 21 hours ago•CVE-2026-77413
9.3CVE-2026-77413: Remote Code Execution via Prototype Chain Bypass in JSONata Evaluator
A critical prototype pollution and sandbox escape vulnerability was discovered in the JSONata query and transformation library before versions 1.8.8 and 2.2.0. By providing a malicious JSONata expression that bypasses ownership checks on object properties, remote attackers can execute arbitrary code in the context of the host Node.js application.
5 views•6 min read