CVE-2026-17613: Missing Authorization

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...

CVE-2026-55998: Observable Response Discrepancy

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-17515: Exposure of Sensitive Information to an Unauthorized Actor

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Esta...

PT-2026-68169

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw exists in the SAML metadata import functionality of the keycloak-services component, which serves as the core engine for identity brokering. When identity provider...

PT-2026-68176

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the LDAP storage provider used to federate user identities from external directories. When a delegated administrator performs a search using a specific LDAP entry...

CVE-2026-71279: Improper Limitation of a Pathname to a Restricted Directory

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. The extension handler only validates that the...

CVE-2026-18856: Server-Side Request Forgery (SSRF)

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

CVE-2026-70588

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1...

Cross-site Scripting (XSS)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Universal Import process. An attacker can inject malicious scripts into post content by importing specially crafted data. Details Cross-site scripting or XSS is a code...

Ghost: Cross-Site Scripting in Universal Import

Impact The Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. Vulnerable versions This vulnerability is present in Ghost from v5.26.0 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters...

GHSA-2GX6-7GX2-WWCF Ghost: Cross-Site Scripting in Universal Import

Impact The Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. Vulnerable versions This vulnerability is present in Ghost from v5.26.0 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters...

NPM: Ghost: Cross-Site Scripting in Universal Import

NPM: Ghost: Cross-Site Scripting in Universal Import vulnerability discovered by ? in WordPress Npm ghost versions = 5.26.0, 6.54.1...

CVE-2026-70588

CVE-2026-70588 affects the Ghost CMS (Node.js). From 5.26.0 through 6.54.1, the Universal Import feature in Ghost Admin did not properly sanitize imported content, causing an XSS in post content. The issue has been fixed in version 6.54.1. Affected versions should upgrade to 6.54.1 or later to re...

CVE-2026-70588

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1...

EUVD-2026-52928

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1...

CVE-2026-70588 Ghost: Cross-Site Scripting in Universal Import

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1...

CVE-2026-70588 Ghost: Cross-Site Scripting in Universal Import

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1...

CVE-2026-70588 Ghost: Cross-Site Scripting in Universal Import

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1...

CVE-2026-69264

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

GHSA-52FH-8V99-63C2 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This...