•about 2 hours ago•CVE-2026-54720
5.4CVE-2026-54720: Stored Cross-Site Scripting (XSS) via Sandbox Bypass in Silverstripe Framework
CVE-2026-54720 is a stored Cross-Site Scripting (XSS) vulnerability inside the Silverstripe Framework's media shortcode processor. Due to a flawed performance optimization, HTML inputs containing two or fewer opening angle brackets bypassed security sandboxing. This flaw allows authenticated or lower-privileged users to inject administrative panel payloads that execute arbitrary client-side JavaScript when viewed by system administrators.
2 views•6 min read
•about 3 hours ago•CVE-2026-54713
3.7CVE-2026-54713: Idempotency Key Collision and Silent Job Dropping in cakephp/queue
An incomplete array comparison vulnerability in cakephp/queue version 0.1.11 through 2.3.0 allows unauthenticated attackers to cause key collisions in unique job deduplication. This is caused by standard array value sorting that discards associative keys, normalizing different payload keys to identical arrays and leading to a denial of service (DoS) by dropping legitimate jobs.
1 views•7 min read
•about 4 hours ago•CVE-2026-55558
5.9CVE-2026-55558: STARTTLS Response Injection in aiosmtplib
An input buffering vulnerability exists in the aiosmtplib asynchronous SMTP client library before version 5.1.2. When upgrading a plaintext connection to TLS via STARTTLS, the library processes buffered plaintext responses after transport negotiation has completed. This behavior allows a network-positioned attacker to inject spoofed server responses prior to negotiation, leading to command/response desynchronization, arbitrary capability injection, and potential credential theft.
2 views•6 min read
•about 5 hours ago•CVE-2026-54770
6.1CVE-2026-54770: Open Redirect via Parser Differential in WebOb
An open redirect vulnerability exists in WebOb before version 1.8.11 due to a parser differential between WebOb's validation logic and Python's standard urllib.parse.urljoin() function. Under Python 3.10+, the urljoin function strips leading and trailing space characters and C0 control characters, which allowed specially crafted inputs to bypass WebOb's prefix checks while still resolving as off-host redirects.
3 views•7 min read
•about 6 hours ago•CVE-2026-54687
6.1CVE-2026-54687: Path Traversal via User-Controlled Database File Path in n8n-nodes-sqlite3
Prior to version 1.0.0, the n8n-nodes-sqlite3 integration exposed the db_path parameter as an unrestricted node parameter. By default, n8n node parameters allow the evaluation of dynamic data expressions, meaning untrusted external input could be mapped to the database path. This vulnerability allows an external attacker to control which SQLite database file the n8n backend process attempts to open, leading to directory traversal outside of the intended directory context.
5 views•5 min read
•about 7 hours ago•CVE-2026-42350
5.1CVE-2026-42350: Client-Side Open Redirect in Kargo UI OIDC Authentication Flow
A client-side open redirect vulnerability has been identified in the Kargo user interface. The flaw resides in the handling of OpenID Connect (OIDC) login and token renewal flows, where the application extracts an unvalidated destination path from the redirectTo query parameter. Attackers can exploit this to redirect authenticated users to arbitrary external domains.
4 views•6 min read
•about 8 hours ago•CVE-2026-54718
7.2CVE-2026-54718: Remote Code Execution via Advanced Workflow Email Template in Silverstripe
A Server-Side Template Injection (SSTI) vulnerability in the Silverstripe Advanced Workflow module allows authenticated attackers with workflow authoring permissions to achieve arbitrary code execution. By manipulating the NotifyUsersWorkflowAction.EmailTemplate field, attackers can inject template code that dynamically executes arbitrary PHP commands via the core translation helper interpolation path.
9 views•4 min read
•about 9 hours ago•CVE-2026-54732
6.5CVE-2026-54732: Arbitrary File Write via Path Traversal in libreoffice-convert
A path traversal and arbitrary file write vulnerability exists in the libreoffice-convert Node.js package in all versions prior to 1.8.2. The convertWithOptions function fails to validate or sanitize the caller-controlled options.fileName parameter, allowing directory traversal sequences to write files outside the temporary directory.
5 views•6 min read
•about 10 hours ago•GHSA-MF7Q-R4RV-JV94
8.2GHSA-MF7Q-R4RV-JV94: Time-of-Check to Time-of-Use (TOCTOU) Signature Verification Bypass in Crossplane Runtime
Crossplane's runtime package manager engine contains a Time-of-Check to Time-of-Use (TOCTOU) race condition in its container signature verification pipeline. When Crossplane parses package definitions using dynamic tag-based references, it resolves the tag on the remote OCI registry twice: once during the signature verification step (the 'Check' phase) and once during the fetch and install step (the 'Use' phase). An attacker controlling the destination OCI registry can exploit this vulnerability by serving a validly signed benign image for the verification phase, and then dynamically swapping the tag to point to an unsigned, malicious package during the fetch phase.
4 views•7 min read
•about 11 hours ago•CVE-2026-54721
8.8CVE-2026-54721: Remote Code Execution via Server-Side Template Injection in Silverstripe UserForms
A Server-Side Template Injection (SSTI) vulnerability in the Silverstripe UserForms module allows authenticated CMS users with basic form configuration privileges to achieve remote code execution (RCE). The flaw resides in the processing of the email recipient subject field, where user-supplied template translation tags are evaluated by the template engine, leading to arbitrary PHP execution via dynamic variable interpolation.
5 views•5 min read
•about 19 hours ago•CVE-2026-54356
7.1CVE-2026-54356: Missing Authorization in Budibase leading to Arbitrary S3 Upload URL Generation
CVE-2026-54356 is a missing authorization vulnerability (CWE-862) within the backend component of the Budibase low-code platform. The vulnerability exists inside the `@budibase/server` package in versions prior to 3.41.3. An authenticated user with the lowest privilege level can invoke the attachment upload URL endpoint directly and obtain an S3 pre-signed PutObject URL signed with the server's S3 credentials.
7 views•5 min read
•about 20 hours ago•CVE-2026-54556
8.2CVE-2026-54556: Heap Exhaustion and Denial of Service in http4s Ember HTTP/2 Backend via HPACK Bomb
CVE-2026-54556 is a high-severity Denial of Service (DoS) vulnerability impacting the Ember HTTP/2 backend of http4s, a popular functional Scala interface for HTTP services. The vulnerability arises from an improper handling of highly compressed HPACK header blocks, which enables unauthenticated remote attackers to trigger severe memory amplification and crash the JVM runtime via an OutOfMemoryError.
5 views•6 min read