CVE-2026-92588

n8n is a workflow automation platform. In versions before 1.123.76 , 2.37.7 , and 2.38.2 , the source control push endpoint derived the set of files to push from client-supplied file paths and status rather than from server-side status computed for the requesting user. An authenticated project-sc...

Linux Distros Unpatched Vulnerability : CVE-2026-88036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file...

DEBIAN-CVE-2026-88036

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier...

DEBIAN-CVE-2026-88034

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifi...

CVE-2026-88029

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

EUVD-2026-75638

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-53760

Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include...

CVE-2026-53760

Admidio versions 5.0.11 and prior are affected by a CSRF vulnerability in the modules/plugins.php endpoint. Plugin install, uninstall, and update operations are handled via GET requests without CSRF token validation. Because browsers send SameSite=Lax cookies on top-level navigations, an attacker...

CVE-2026-53760 Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include...

gitpython: GitPython: Arbitrary File Overwrite via `git read-tree` option injection

A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the git read-tree command through methods like IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree, without proper option validation or...

CVE-2026-76219

A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the git read-tree command through methods like IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree, without proper option validation or...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Added idatasem protection in ext4destroyInlinedatanolock Fixed a race condition between inline data destruction and block mapping. The function ext4destroyInlinedatanolock changes the inode data layout by clearing...

CVE-2026-67217

A flaw was found in cJSON. The library applies RFC 6902 JSON Patch operations non-atomically. A remote attacker, by supplying a specially crafted patch document e.g., a 'replace' operation missing its value or a 'move' operation with an unresolved destination, can cause the existing target data t...

CVE-2026-47233

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-18712

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

EUVD-2026-56885

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

PT-2026-70864

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in Queryable Encryption maintenance operations allows an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of da...

Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Impact Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets. Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication. Patches This has been fixed in 5.74.1 and...

GHSA-J2VP-F2PV-5RJ4 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Impact Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets. Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication. Patches This has been fixed in 5.74.1 and...

CVE-2026-64663 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation...