Archive
26 September 2026
Vulnerabilities first published on this day (UTC), newest first.
245 results · Feed
-
High 7.7
Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib
Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries (resource.Lib, http.Lib, configMap loader) which are handed the policy namespace. …
-
Medium 5.9
Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion
Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host…
-
Medium 5.9
Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString…
-
High 7.5
nodemailer before 10.0.6 Denial of Service via addressparser
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block t…
-
Medium 5.8
Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex
Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail …
-
Medium 5.3
Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment
Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated d…
-
High 8.6
Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickh…
-
Medium 5.8
Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect() befor…
-
Medium 6.1
Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adm…
-
Medium 6.1
Hugo before 0.166.0 Cross-Site Scripting via text/org
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-sit…
-
High 8.4
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch fr…
-
Medium 5.4
Hugo before 0.166.0 Stored XSS via lineAnchors code block option
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the g…
-
High 7.5
Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for …
-
High 7.5
Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model valid…
-
Medium 5.9
GitPython before 3.1.62 Path Traversal via gitmodules path
GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the `name` field, and GitPython's own containme…
-
Medium 6.5
Budibase server before 3.45.0 Cross-Tenant Information Disclosure
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can sup…
-
Medium 5.5
Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast
Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing databas…
-
High 8.1
Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps
Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-ap…
-
High 8.1
Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC
Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted e…
-
High 7.7
Budibase before 3.45.0 Information Disclosure via Chat Links
Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensiti…
-
High 8.0
Budibase before 3.45.0 SQL Injection via column-rename DDL
Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string (backtick-quoted for MySQL, a single-quoted sp_rename literal for MSS…
-
Medium 5.4
Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submi…
-
High 8.8
Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink
Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink en…
-
High 8.1
Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import
Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI sp…
-
High 8.8
stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it wi…
-
Medium 6.5
stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attemp…
-
Medium 5.3
stoatchat before 0.15.5 Account Enumeration via Error Location
stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error…
-
High 8.2
stoatchat before 0.15.5 Local Filesystem Read via SVG
January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG <image href> values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who c…
-
Medium 6.5
stoatchat before 0.15.5 Denial of Service via mass mentions
stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling …
-
Medium 4.3
stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization
stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists…
-
High 7.5
grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure
The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the admin servic…
-
High 8.2
Grav Data Manager before 1.4.5 Stored XSS via item-detail view
The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/item.html.twig) without escaping, applying Twig's `raw` filter — in some cases after a str…
-
High 8.0CVE-2026-100671 Public exploit
Grav before 2.0.25 Session Cookie Theft via Twig Sandbox
Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that…
-
High 8.8
Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass
Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admin.super` guard that is resolved by the field's exact path, so a submitted flat dot-notation key such…
-
High 7.5
Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass
Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config (IIS), every deny rule (user_sensitive_folders, user_accounts, user_data, user_error_redirect, user_pages, …
-
Medium 6.5
Grav before 2.0.25 Sandbox Escape via array Filter
Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on the sandbox allowlist but is registered without the needs_is_sandboxed guard that print_r, vardump, json_encode, yaml_encode and string…
-
Medium 5.3
grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass
grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login:…
-
High 7.3
Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1x…
-
High 7.5
Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust m…
-
High 7.5
Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUti…