CVE-2026-53573

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This...

CVE-2026-53573

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This...

CVE-2026-53573 core-geonetwork has an Open Redirect Bypass

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This...

CVE-2026-68771

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard.pkl file via...

CVE-2026-68771 ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard.pkl file via...

CVE-2026-62999 Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-62999 Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-62999

Copier (library and CLI for rendering project templates) is affected from version 9.5.0 through 9.16.0. Percent-encoded parent-directory segments or encoded path separators in a template URL could match a configured trusted repository prefix before HTTP server or Git transport decoding, enabling ...

CVE-2026-62999

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-62999 Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

Directory Traversal

Overview thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Directory Traversal via the fileloader process. An attacker can access arbitrary files outside the intended directory by supplying specially crafted,...

Denial of Service (DoS)

Overview thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Denial of Service DoS via the proportion filter process. An attacker can exhaust system resources and cause service disruption by supplying an excessively large...

Division by zero

Overview thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Division by zero via the convolution filter process in the C extension when user-controlled input is used as a divisor without validation. An attacker can cause...

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

Impact A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5. The library recursively merged user-supplied objects without filtering unsafe property names such as proto, constructor, and prototype. An attacker able to supply crafted input could cause properti...

GHSA-MJ3G-7XCC-X4VH @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

Impact A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5. The library recursively merged user-supplied objects without filtering unsafe property names such as proto, constructor, and prototype. An attacker able to supply crafted input could cause properti...

EUVD-2026-51592

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

CVE-2026-54737 @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

CVE-2026-54737

The CVE refers to @phun-ky/defaults-deep, a lodash-like defaultsDeep library. Before 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype (prototype pollution). Affected version ra...

CVE-2025-67650

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the...

CVE-2025-67650 Authenticated SQL Injection in PHP Jabbers scripts

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the...