Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm in the authentication provider's team membership evaluation process. An attacker can gain unauthorized access to resources or permissions assigned to other teams within the same...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm in the authentication provider's team membership evaluation process. An attacker can gain unauthorized access to resources or permissions assigned to other teams within the same...

GHSA-4J6X-2764-M8GH Rancher has over-inclusive team membership expansion in GitHub App authentication provider

Impact A vulnerability has been identified within Rancher Manager in the GitHub App authentication provider. When evaluating permissions, the provider incorrectly expands user team memberships to include all teams within the associated GitHub organization, rather than restricting access to the...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm in the authentication provider's team membership evaluation process. An attacker can gain unauthorized access to resources or permissions assigned to other teams within the same...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm in the authentication provider's team membership evaluation process. An attacker can gain unauthorized access to resources or permissions assigned to other teams within the same...

CVE-2026-13878

creationtimestamp| type| source ---|---|--- 2026-07-01 20:39:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmergu3q22q 2026-07-02 07:22:06+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-54672

A flaw was found in electron-updater, a component used for automatic updates in Electron applications. This vulnerability arises because AppImage targets, built by app-builder-lib, incorrectly add the current working directory to the dynamic linker search path when setting the LDLIBRARYPATH...

CVE-2026-14258

creationtimestamp| type| source ---|---|--- 2026-07-01 11:43:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplgtxfpjx23 2026-07-01 12:43:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplk6tti5626 2026-07-01 15:30:43+00:00| seen|...

EUVD-2026-40437

Capgo before 12.128.2 contains an authorization flaw in POST /private/createdevice that accepts a caller-supplied orgid parameter without validating it matches the target app's owner organization. Authenticated attackers can create device records for an application using a foreign organization...

EUVD-2026-40801

Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a malicious file. Chromium security severity: Low...

EUVD-2026-40809

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-40784

Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-40558

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to potentially perform a sandbox escape via a malicious file. Chromium security severity: Medium...

PT-2026-54645

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. This was possible because the authorization...

@abcum/ember-app (>=0.1.0, <=0.12.0), @abcum/ember-contextmenu (>=3.0.5, <=4.0.1) +318 more potentially affected by CVE-2026-54672 via app-builder-bin (>=1.0.5, <=5.0.0-alpha.13)

app-builder-bin NPM version =1.0.5, =0.1.0, =3.0.5, =0.1.0, =22.6.1-1, =1.0.4, =1.0.0, =0.0.10, =0.0.1, =26.0.11-2, =0.0.1-alpha.0, =0.0.1, =1.0.1, =1.0.1, =1.0.2 and more Source cves: CVE-2026-54672 Source advisory: SNYK:JS-APPBUILDERBIN-17744442...

@depup/electron-builder (26.8.1-depup.0), @lynx-js/lynxtron-builder (>=0.0.1-alpha.0, <=0.0.28) +8 more potentially affected by CVE-2026-54672 via app-builder-lib (>=26.0.0-alpha.0, <=26.14.0)

app-builder-lib NPM version =26.0.0-alpha.0, =0.0.1-alpha.0, =26.8.2-beta.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.14.0 Source cves: CVE-2026-54672 Source advisory: SNYK:JS-APPBUILDERLIB-17744441...

Uncontrolled Search Path Element

Overview app-builder-bin is an app-builder precompiled binaries Affected versions of this package are vulnerable to Uncontrolled Search Path Element through the execWine/executeAppBuilder command path in builder-util and app-builder-lib on non-Windows systems. An attacker can execute...

Uncontrolled Search Path Element

Overview app-builder-lib is an electron-builder lib Affected versions of this package are vulnerable to Uncontrolled Search Path Element through the execWine/executeAppBuilder command path in builder-util and app-builder-lib on non-Windows systems. An attacker can execute attacker-controlled...

CVE-2026-56247

Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending invitees. Attackers can pre-seed malformed high-privilege bindings that survive invite acceptance, enabling accepted low-privilege users to perfor...

DEBIAN-CVE-2026-14131

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...