CVE-2026-105684 Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

CVE-2026-105684 Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

CVE-2026-105684

Prior to version 2.18.0 , the Penpot design and prototyping platform is vulnerable to a page-scope escape in its comment RPC commands. Specifically, the get-comment-threads, get-comment-thread, and get-comments commands fail to enforce share link page restrictions, even though they perform permis...

CVE-2026-105684 Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

Malicious Package

Overview css-at-scope-polyfill is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

keycloak: Keycloak: Denial of Service via excessive processing of OpenID Connect scope parameters

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect OIDC token endpoint. This leads to high resource consumption and prolonged processing times, ultimate...

CVE-2026-105633

The open-source project management tool Plane is vulnerable to an authorization bypass in the V2 issue-attachment PATCH endpoint prior to version 1.4.0 . The root cause is that the server accepts an issue_id in the URL but fails to include it in the database query, matching only on pk, workspace,...

CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

Malicious code in css-at-scope-polyfill (npm)

Source: amazon-inspector c4d8d974b7fabf04fa662971cd8041fb76775bf5ed2902cbbffed0f881e2036d Package is published under a CSS-polyfill name but ships thunderboltRegistry.js, which exports Wix internal registry module names thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, etc...

Malicious code in css-at-scope-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4d8d974b7fabf04fa662971cd8041fb76775bf5ed2902cbbffed0f881e2036d Package is published under a CSS-polyfill name but ships thunderboltRegistry.js, which exports Wix internal registry module names thunderboltRegistry...

MAL-2026-17547 Malicious code in css-at-scope-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4d8d974b7fabf04fa662971cd8041fb76775bf5ed2902cbbffed0f881e2036d Package is published under a CSS-polyfill name but ships thunderboltRegistry.js, which exports Wix internal registry module names thunderboltRegistry...

EUVD-2026-91955

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-75028: Improper Control of Filename for Include/Require Statement in PHP Program

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

PT-2026-104543

Name of the Vulnerable Software and Affected Versions WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System versions prior to 3.0.19 Description The plugin is susceptible to Local File Inclusion, a flaw that allows an attacker to include files from the local server. Authenticated...

CVE-2026-104443

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership...

EUVD-2026-91454

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership...

CVE-2026-104443

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership...

CVE-2026-104443 YesWiki before 4.6.7 Scope Bypass via Triples Delete API

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership...