CVE-2026-55584

CVE-2026-55584 - phpSysInfo IP Allowlist Bypass CWE-290, CVSS 7.5 High, phpSysInfo = 3.4.5 Refs: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED resolves the client IP from the attacker-controlled X-Forwarded-For then Client-IP headers before falling back to REMOTEADDR. There is no trusted-proxy concept,...

CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

EUVD-2026-104814

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-110306 fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-110306

The fast-uri Node.js URI parser and serializer is vulnerable to URI scheme spoofing in versions before 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.2.2. The root cause is that the library uses the legacy global unescape() function to percent-decode the scheme component before validation. This ...

NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...

PT-2026-118254

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-112771

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue without consulting the sandbox security policy. Authenticated...

EUVD-2026-104586

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-@ directives past the callable check to invoke...

CVE-2026-112780 Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-@ directives past the callable check to invoke...

CVE-2026-112780

The Grav content management system, versions 2.0.15 before 2.2.2 , is vulnerable to an allowlist bypass that enables arbitrary public static method calls. By renaming Flex form fields with replace-name@, an attacker with page-edit permissions can bypass callable checks to smuggle data-*@ directiv...

EUVD-2026-104577

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue without consulting the sandbox security policy. Authenticated...

CVE-2026-112771

Craft CMS versions 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 are vulnerable to a Twig sandbox allowlist bypass . The issue arises because specific filters—including column , contains , filterByValue , index , where , and multisort —resolve caller-supplied keys using ArrayHelper::getValue() with...

CVE-2026-112771 Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue without consulting the sandbox security policy. Authenticated...

CVE-2026-112771 Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue without consulting the sandbox security policy. Authenticated...

CVE-2026-27876

CVE-2026-27876: Grafana SQL Expressions Arbitrary File Write to RCE CVSS 9.1 Critical | Arbitrary File Write | Remote Code Execution Demo https://github.com/user-attachments/assets/c84a4b63-7928-4dba-a069-3bafa036ce56 Summary Grafana's SQL Expressions feature sqlExpressions toggle uses an...

CVE-2026-111388 Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrictip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses...

CVE-2026-111388

The Frappe Framework (versions before 15.120.0 and 16.x before 16.33.0 ) is vulnerable to an allowlist bypass because it fails to enforce the per-user restrict_ip allowlist for non-session authentication methods. This includes authentication via API key , OAuth , and header-based methods. An atta...

log4j-4255

log4j2 4255 — FilteredObjectInputStream allowlist bypass via java.rmi.MarshalledObject A self-contained, containerised lab that reproduces Apache log4j2 issue4255 end-to-end against the official Log4j 2.26.1 artifacts on JDK 17 , with positive controls, a hardened oracle, and a validated...

PYSEC-2026-4254 PraisonAI: Shell command allowlist bypass via find -exec built-in action

Summary The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj utility-tools shell chaining and GHSA-vjv9-7m7j-h833 SandboxExecutor chaining can be bypassed via find's built-in -exec action. The fix blocks shell metacharacters ;|& + The ...