EUVD-2026-87853

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

CVE-2026-100833 Contrast before 1.23.1 Image Substitution via Policy Generation

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

CVE-2026-101089: Insufficiently Protected Credentials

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-101086: Improper Privilege Management

Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with nezha:service:write scope to submit privileged task types through the service API. Attackers can deliver command execution or Agent configuration tasks to...

PT-2026-99539

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 2.1.16 Sylius versions prior to 2.2.9 Description Insufficient restriction of payment request actions in the Shop API endpoint allows customers to trigger refunds on completed orders. An attacker possessing order token...

PT-2026-99482

Name of the Vulnerable Software and Affected Versions heym versions prior to 0.0.91 Description This workflow automation platform stores and returns multiple capability secrets in plaintext. Affected secrets include webhook header-auth values, which are returned in cleartext by the 'GET...

PT-2026-99717

Name of the Vulnerable Software and Affected Versions Nezha versions prior to 2.2.7 Description An information disclosure issue exists where the 'GET /api/v1/profile' endpoint returns the bcrypt-hashed password field of authenticated users. This allows attackers to extract password hashes and...

PT-2026-99471

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description Broken access control allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. By calling the 'GET /api/station/id/vue/profil...

CVE-2026-101085: Numeric Truncation Error

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint t...

CVE-2026-101050: Improper Authentication

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

CVE-2026-101061: Server-Side Request Forgery (SSRF)

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...

CVE-2026-100851: Exposure of Sensitive Information to an Unauthorized Actor

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...

PT-2026-99467

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description A DQL injection issue exists in the AbstractSearchableListAction.php file. An attacker can inject arbitrary DQL Doctrine Query Language expressions—an object-oriented query language used by the...

PT-2026-99470

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description An issue exists in the AutoDJ remote playlist fetch functionality within the getMediaFromRemoteUrl function. A user with station Media permissions can create or update a playlist by setting source...

PT-2026-99713

Name of the Vulnerable Software and Affected Versions Nezha versions prior to 2.3.8 Description Authenticated non-administrator users can create malformed alert rules due to a lack of validation for alert rule types and duration bounds. By submitting a crafted alert rule via the 'POST...

PT-2026-99573

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...

CVE-2026-100871: Improper Authentication

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

PT-2026-99714

Name of the Vulnerable Software and Affected Versions Nezha Dashboard versions prior to 2.3.5 Description Authenticated users with nezha:service:write scope can submit privileged task types through the service API because the system fails to restrict service monitor task types to supported probe...

CVE-2026-100862: Cleartext Storage of Sensitive Information

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

PT-2026-99541

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 1.12.25 Sylius versions prior to 1.13.17 Sylius versions prior to 1.14.20 Sylius versions prior to 2.1.16 Sylius versions prior to 2.2.9 Description JWT tokens issued by separate Admin and Shop API endpoints fail to...