EUVD-2026-93772

LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, .first/.last, negative index, and for-loop iteration...

NPM: LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

NPM: LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, .first/.last, negative index, and for-loop iteration vulnerability discovered by ? in WordPress Npm liquidjs versions = 10.27.1...

GHSA-FWXR-J5W2-587M LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

Summary LiquidJS’s ownPropertyOnly option is intended to prevent templates from reading inherited or prototype properties from scope data. With ownPropertyOnly: true, direct access such as: liquid a0 correctly blocks an inherited array index. However, the same inherited value is still disclosed...

CVE-2026-107222: Improper Validation of Array Index

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches...

CVE-2026-106120 LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and...

CVE-2026-106120 LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and...

CVE-2026-106120

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and...

CVE-2026-106120 LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and...

CVE-2026-105860

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants...

CVE-2026-105860

The Payload headless content management system is vulnerable to a tenant authorization bypass in the @payloadcms/plugin-multi-tenant plugin. In versions before 3.90.0 and canary versions before 4.0.0-canary.34 , the default tenant array field access allows an authenticated user to assign their ow...

GHSA-4V7V-GQF9-WW2G Vyper: Call stack corruption when passing complex type containing non-base type members as argument

Impact When we pass a multi-dimensional array like 1, 2, 3, 4 as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct. Example code:...

Vyper: Call stack corruption when passing complex type containing non-base type members as argument

Impact When we pass a multi-dimensional array like 1, 2, 3, 4 as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct. Example code:...

PT-2026-115803

In the Linux kernel, the following vulnerability has been resolved: Input: soc button array - check btns desc-package.count Check that btns desc-package.count is not 0 before accessing btns desc-package.elements0...

Linux Distros Unpatched Vulnerability : CVE-2026-98291

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix off-by- one bounds check in RX submit btintelpciesubmitrx used...

PT-2026-106793

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-multi-tenant versions prior to 3.90.0 @payloadcms/plugin-multi-tenant canary versions prior to 4.0.0-canary.34 Description An authenticated user can assign their own account to other tenants due to the default tenant array...

PT-2026-106841

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.27.2 Description When the ownPropertyOnly setting is enabled, the engine fails to consistently restrict inherited array indices. This occurs because negative indexing, .first, .last, the first filter, the last...

PT-2026-106532

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the soc button array component where the system fails to verify that btns desc-package.count is not 0 before attempting to access btns desc-package.elements0. This lack o...

ALSA-2026:76781 Moderate: glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name service cache daemon nscd used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fixes: glibc:...

CVE-2026-105860: Missing Authorization

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants...

PT-2026-115980

Impact When we pass a multi-dimensional array like 1, 2, 3, 4 as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct. Example code:...