•3 minutes ago•CVE-2026-77415
9.3CVE-2026-77415: Sandbox Escape and Arbitrary Code Execution in JSONata Engine
A critical sandbox escape vulnerability in JSONata versions prior to 1.8.8 and 2.2.1 allows unauthenticated remote attackers to execute arbitrary code on the host machine. By submitting crafted JSONata expressions, an attacker can manipulate internal AST structures, bypass object clone helpers, spoof native function flags, and escape the evaluation environment to execute system commands through the Node.js runtime.
0 views•6 min read
•about 1 hour ago•CVE-2026-77414
9.3CVE-2026-77414: Critical Sandbox Escape and Remote Code Execution in JSONata via Prototype Pollution
CVE-2026-77414 (GHSA-2943-5xfg-gq5f) is a critical sandbox escape and remote code execution vulnerability in the JSONata package. When JSONata processes untrusted expressions, it uses a vulnerable environment lookup check that can be shadowed by user-defined variables. Attackers can leverage this to traverse the prototype chain, reach the global Function constructor, and execute arbitrary system commands on the host machine.
6 views•7 min read
•about 2 hours ago•GHSA-8HGV-XC77-JMCR
9.0GHSA-8HGV-XC77-JMCR: Privilege Escalation to Super-Admin via Twig Sandbox Escape and Stored XSS in Grav CMS Assets
An overly permissive default configuration in the Grav CMS Twig sandbox combined with a lack of neutralization of double-quote characters in the Asset rendering engine allows low-privileged page editors to inject malicious JavaScript into administrative contexts. This leads to a stored cross-site scripting (XSS) condition that compromises the sessions of super-administrators, facilitating complete privilege escalation.
3 views•6 min read
•about 3 hours ago•GHSA-8CFW-PCWH-V63W
8.5GHSA-8CFW-PCWH-V63W: Authenticated Twig Sandbox Escape and Remote Code Execution in Winter CMS
An authenticated Twig sandbox escape vulnerability in Winter CMS allows users with template-editing privileges to bypass sandbox restrictions and execute arbitrary PHP code. This vulnerability represents a complete bypass of the sandbox protections introduced by the previous patch for CVE-2024-54149.
3 views•6 min read
•about 4 hours ago•GHSA-Q9C5-PP7M-FM2G
5.3GHSA-Q9C5-PP7M-FM2G: Missing Authorization in Fleet Enterprise iOS Application Distribution Endpoints
A missing authorization vulnerability in Fleet device management software allows unauthenticated remote attackers to access proprietary enterprise iOS packages (.ipa) and manifest configurations by scanning predictable integer identifiers.
2 views•7 min read
•about 6 hours ago•CVE-2026-59995
4.2CVE-2026-59995: Relative Path Traversal in OpenSSH sftp Client
A relative path traversal vulnerability (CWE-23) in the client-side sftp utility of OpenSSH before version 10.4 allows malicious or compromised SFTP servers to write or overwrite files outside the intended destination directory when a user executes a direct one-shot download command.
6 views•6 min read
•about 7 hours ago•GHSA-RXHG-VCWW-2MPW
8.1GHSA-RXHG-VCWW-2MPW: SQL Injection via ORDER BY Column Injection in Fleet Activity List Endpoints
A SQL injection vulnerability exists in the activity list endpoints of Fleet Device Management. Authenticated users can manipulate the order_key parameter to sort database queries by arbitrary columns, including columns not projected in the SELECT query. This flaw allows attackers to establish an inference oracle to extract sensitive information from the database.
4 views•5 min read
•about 9 hours ago•GHSA-7MPF-4465-7FC2
2.0GHSA-7mpf-4465-7fc2: Stored Cross-Site Scripting in Winter CMS Backend List Widget
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Backend List widget of Winter CMS (winter/wn-backend-module). When a list column is configured with the 'image' type and displays attacker-controlled input, the lack of sanitization in the image URL allows injection of arbitrary HTML attributes, potentially executing malicious scripts in the session of administrators viewing the list.
3 views•5 min read
•about 10 hours ago•GHSA-MPMW-F6H6-3G26
4.3GHSA-mpmw-f6h6-3g26: Insecure Direct Object Reference in Winter CMS My Account Controller
An Insecure Direct Object Reference (IDOR) vulnerability was identified in Winter CMS version 1.2.13. The vulnerability exists within the newly introduced Backend\Controllers\MyAccount controller, which utilizes the FormController behavior without appropriate model query scoping or routing controls. This allows authenticated, low-privilege backend users to retrieve sensitive personal and administrative data of other backend accounts by enumerating record identifiers via standard CRUD routes.
4 views•5 min read
•about 11 hours ago•GHSA-FM29-4MQ3-PHG6
8.1GHSA-FM29-4MQ3-PHG6: Missing Authorization in Winter CMS ImportExportController Behavior
Winter CMS contains an authorization bypass vulnerability within its ImportExportController behavior. Due to a design flaw in the request lifecycle processing, permissions configured for data import and export operations are not validated during AJAX-based requests, allowing authenticated users with limited privileges to perform unauthorized data exfiltration or database manipulation.
5 views•5 min read
•about 12 hours ago•GHSA-5CWR-5JXG-PCF6
8.4GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles
Winter CMS versions prior to 1.2.14 are vulnerable to Stored Cross-Site Scripting (XSS) within the administrative backend interface. The flaw resides in the custom styles rendering pipeline for Brand Settings and Editor Settings. An attacker with privileges to modify backend branding or editor configurations can inject arbitrary JavaScript, which is written to the cache without sanitization. Subsequent page requests that result in a cache hit completely bypass output sanitization filters, leading to JavaScript execution in the sessions of other administrative users.
5 views•6 min read
•about 13 hours ago•GHSA-P2CH-C2C3-4XM5
8.8GHSA-P2CH-C2C3-4XM5: Cross-Site Request Forgery in Winter CMS AJAX Routing
Winter CMS contains a routing bypass vulnerability that allows Cross-Site Request Forgery (CSRF) attacks to trigger administrative AJAX handlers. Due to case-insensitivity in PHP's method resolution and an insufficiently strict check in the backend controller system, an attacker can invoke these handler methods through lowercase HTTP GET requests, bypassing default CSRF token validation.
5 views•4 min read