CVE-2026-54150 next-video: Unauthenticated arbitrary file read via /api/video request handler

next-video is a library for adding video to Next.js applications. Prior to 2.8.1, the GET endpoint exported by next-video/request-handler and commonly mounted at /api/video accepts an unauthenticated url query parameter, while src/utils/utils.ts isRemote treats any value without an HTTP or HTTPS...

CVE-2026-55102

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

CVE-2026-55253

A NoSQL injection vulnerability in the langgraph-checkpoint-mongodb (< 0.3.0) and langgraph-store-mongodb (

CVE-2026-55253 LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...

CVE-2026-55253 LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...

CVE-2026-55253 LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...

CVE-2026-50157 Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK

Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate and Authorizer::supports paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as t...

CVE-2026-55102

CVE-2026-55102 affects hashi-vault-js , a Node.js module for interacting with the HashiCorp Vault API, in versions prior to 0.5.2 . Every API method in src/Vault.js rethrows the raw AxiosError via parseAxiosError(), retaining the full Axios configuration including the X-Vault-Token header and err...

EUVD-2026-77640

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

CVE-2026-55102 hashi-vault-js: Vault token and secret values exposed in thrown errors

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

CVE-2026-55102 hashi-vault-js: Vault token and secret values exposed in thrown errors

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

CVE-2026-55102 hashi-vault-js: Vault token and secret values exposed in thrown errors

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

OESA-2026-3733 git security update

Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. Git is easy to learn and has a tiny footprint with lightning fast performance. It outclasses SCM tools like Subversion, CVS, Perforce, and...

CVE-2026-57131

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.createapp mounts praisonai.jobs.router.createrouter under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read job...

EUVD-2026-77583

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...

CVE-2026-54529

SQLAdmin , a Python admin interface for SQLAlchemy models, is vulnerable to an information-exposure ordering oracle via the unvalidated sortBy query parameter in ModelView.sort_query() (prior to 0.27.1 ). The root cause is that column_sortable_list is enforced only in the frontend template to dec...

EUVD-2026-77581

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

CVE-2026-54529 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

CVE-2026-54529 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

CVE-2026-82434

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...