•about 8 hours ago•CVE-2026-46696
3.3CVE-2026-46696: Safe Mode Sandbox Bypass in October CMS via Session Store and Forwarded Builder Calls
CVE-2026-46696 identifies a critical sandbox bypass vulnerability in the October CMS platform that affects the Twig template security policy when safe mode is enabled. An authenticated backend user with permissions to modify CMS markup templates can chain unrestricted session store method access with Eloquent database query forwarding omissions. This chain allows the attacker to execute arbitrary raw SQL queries to read system secrets and subsequently write those secrets directly to the active session payload, achieving unauthorized administrative privilege escalation.
6 views•8 min read
•about 9 hours ago•CVE-2026-49400
3.3CVE-2026-49400: PHP Object Injection Sandbox Escape in October CMS SessionMaker
A security vulnerability in October Content Management System (CMS) involves the deserialization of untrusted data (CWE-502) within the backend SessionMaker trait. Prior to the patched versions, October CMS stored widget session states as base64-encoded serialized PHP objects. When loading these states, the application consumed them using unserialize() without enforcing class restrictions (allowed_classes). In configurations where cms.safe_mode is enabled to sandbox users with markup editor privileges, an attacker can exploit this behavior to instantiate arbitrary PHP classes and execute arbitrary code via accessible gadget chains.
8 views•6 min read
•about 10 hours ago•CVE-2026-56668
8.1CVE-2026-56668: Privilege Escalation and Cross-Client Audience Bypass in ZITADEL OAuth2 Token Exchange
A security vulnerability in ZITADEL's backend implementation of the OAuth2 Token Exchange endpoint allows authenticated clients to perform scope escalation and cross-client audience bypass. Prior to version 4.15.3, the Token Exchange flow lacked crucial validation logic, enabling low-privilege tokens to be exchanged for high-privilege tokens or tokens valid within other client applications, violating the OAuth2 delegation model.
7 views•7 min read
•about 11 hours ago•CVE-2026-76081
5.5CVE-2026-76081: Improper Role Revocation in ZITADEL Dynamic Project Grants
CVE-2026-76081 is a logical vulnerability in ZITADEL's role cascading logic where updating a Project Grant to drop multiple adjacent roles simultaneously fails to clean up associated User Grants due to an in-place slice mutation error in Go.
10 views•6 min read
•about 12 hours ago•GHSA-2XMM-M4WV-3FJH
3.9GHSA-2XMM-M4WV-3FJH: Incomplete Scheme Validation in October CMS Image Resizer
This report provides a technical analysis of GHSA-2XMM-M4WV-3FJH, an incomplete scheme validation vulnerability in the image resizing utility of October CMS. By exploiting this flaw, authenticated or privileged users can pass dangerous URI schemes to trigger deserialization of untrusted metadata.
4 views•5 min read
•about 14 hours ago•CVE-2026-59178
9.8CVE-2026-59178: Authentication Bypass in ESPHome Device Builder Dashboard
An authentication bypass vulnerability in ESPHome Device Builder Dashboard allows unauthenticated remote attackers to gain administrative access. The flaw is caused by a backward compatibility break during an environment variable rename that silently disables dashboard authentication upon upgrade.
6 views•6 min read
•about 17 hours ago•CVE-2026-61534
9.1CVE-2026-61534: Prototype Pollution in confetti yayson JSON:API Deserialization Engine
A critical prototype pollution vulnerability was discovered in the confetti yayson library prior to version 4.3.0. The library deserializes JSON:API structures into internal cache dictionaries mapped with standard JavaScript objects. An attacker can control the cache keys by supplying '__proto__' in properties like type or id, modifying the prototype of all JavaScript objects process-wide.
4 views•7 min read
•3 days ago•CVE-2026-11748
6.9CVE-2026-11748: Unauthenticated LDAP Injection in Central Dogma Server Authentication
An LDAP injection vulnerability exists in the centraldogma-server-auth-shiro module of LY Corporation Central Dogma before version 0.84.0. The search logic dynamically constructs LDAP search filters by interpolating user-provided usernames without escaping RFC 4515 metacharacters. Unauthenticated remote attackers can leverage this flaw to bypass authentication, enumerate directory hierarchies, and access unauthorized resources.
14 views•6 min read
•3 days ago•CVE-2026-11746
9.4CVE-2026-11746: Use of Hard-coded ZooKeeper Replication Secret 'ch4n63m3' in Central Dogma Server
CVE-2026-11746 is a critical vulnerability in Central Dogma Server prior to version 0.84.0, where an embedded ZooKeeper replication secret silently falls back to a publicly known, hard-coded default string ('ch4n63m3'). Remote attackers with access to the replication network can authenticate as legitimate cluster peers, potentially leading to unauthorized data exposure, state manipulation, or complete cluster takeover.
10 views•6 min read
•3 days ago•CVE-2026-56665
4.2CVE-2026-56665: Logical Validation Bypass in ZITADEL External JWT Identity Provider
A logical verification flaw in ZITADEL's external JWT Identity Provider validation allows attackers to bypass session expiration checks. If an incoming JWT lacks the 'exp' claim, the system skips validation entirely, creating an indefinitely valid session. This issue has been addressed in versions 3.4.12 and 4.15.2.
12 views•7 min read
•3 days ago•CVE-2026-59149
6.5CVE-2026-59149: Sibling Directory Path Traversal in Mockoon Backend Server
CVE-2026-59149 identifies a directory traversal vulnerability in `@mockoon/commons-server`, the backend mock-server library powering the Mockoon application. The flaw occurs in the path containment validation logic used during raw file response generation. An unauthenticated attacker can exploit this weakness to retrieve arbitrary files from sibling directories sharing a common prefix with the designated static base directory.
16 views•5 min read
•3 days ago•CVE-2026-59148
8.8CVE-2026-59148: Unauthenticated Administrative API and CORS Misconfiguration in Mockoon
An in-depth analysis of CVE-2026-59148, a high-severity flaw in Mockoon where unauthenticated administrative endpoints and a wildcard Cross-Origin Resource Sharing (CORS) policy allow remote execution, state poisoning, and credential theft.
17 views•6 min read