CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2024-58354

Cal.com (cal.com/cal.diy) is affected by a repository takeover via its GitHub Actions workflow. The pr.yml workflow uses pull_request_target and passes repo default write permissions to check-types.yml, which then dangerous-checks out the attacker PR and executes it (yarn install, package.json sc...

EUVD-2026-48426

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

CVE-2026-47724 nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

CVE-2026-47724

Nebula-Mesh (pre-0.3.4) suffers an authorization gap: the /api/v1/* surface largely trusts bearer tokens and enforces ownership only for the Web layer, leaving host, network, firewall, mobile-bundle, and most operator endpoints vulnerable to cross-tenant access. This enables privilege escalation ...

CVE-2026-47724

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

CVE-2026-15967

Issue: Insufficient session expiration in Progress MOVEit Transfer. Affected versions: MOVEit Transfer before 2025.1.5, and 2026.0.0 before 2026.0.3 (i.e., 2026.0.0–2026.0.2). Root cause: Sessions do not expire sufficiently, potentially allowing continued access to active sessions. Impact: High i...

CVE-2026-15967 MOVEit Transfer refresh-token processing does not enforce updated account restrictions

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...

CVE-2026-15212

The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the AjaxService::verifyajaxrequest helper gating its wpverifynonce call behind the boolean option 'enablenoncecheck', which is absent from the default...

CVE-2026-15212

CVE-2026-15212 affects the WPO365 | Login plugin for WordPress (up to version 43.2). The root cause is that Ajax_Service::verify_ajax_request() gates wp_verify_nonce() behind the boolean option enable_nonce_check, which is missing from the default wpo365_options. This causes wp_ajax_wpo365_update...

CVE-2026-47669

CVE-2026-47669 (DbGate Zip Slip) : The unzipDirectory function in DbGate’s API path traversal allows writing files outside the target directory via ZIP entries with “..” (Zip Slip), enabling arbitrary file writes and potential RCE, especially in default Docker deployments running as root. Impact ...

CVE-2026-47669

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the unzipDirectory function in packages/api/src/shell/unzipDirectory.js line 27 does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the...

CVE-2026-65700

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The getuserdir function in...

GO-2026-5987 Insecure enrollment token TTL in nebula-mesh in github.com/forgekeep/nebula-mesh

The nebula-mesh Web UI host creation ignores the configured enrollment token TTL and instead mints 24-hour bearer enrollment tokens. This can lead to tokens remaining valid for longer than intended, increasing the window of opportunity for an attacker to use an intercepted token...

GO-2026-5675 Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster...

CVE-2026-65700

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The getuserdir function in...

CVE-2026-15612

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-15612 LOIDC nonce validation bypass

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-15612

CVE-2026-15612 affects Logto Identity Platform. The vulnerability arises when the OIDC nonce validation is skipped if the id_token omits the nonce claim, because the validation path checks if data.nonce. As a result, a missing nonce can allow replay of authentication tokens and weaken session-bin...