GHSA-VXPW-J846-P89Q vulnerabilities

Vulnerabilities for packages: gemini-cli, actions-runner, renovate, code-server, node-gyp, pelias-api, saf, vitess, py3-captum, npm, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, haraka, kibana, prism...

CVE-2026-11525 vulnerabilities

Vulnerabilities for packages: gemini-cli, actions-runner, renovate, code-server, node-gyp, pelias-api, saf, vitess, py3-captum, npm, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, haraka, kibana, prism...

CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: gemini-cli, actions-runner, renovate, code-server, node-gyp, pelias-api, saf, vitess, py3-captum, npm, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, haraka, kibana, prism...

CVE-2026-9679 vulnerabilities

Vulnerabilities for packages: gemini-cli, actions-runner, renovate, code-server, node-gyp, pelias-api, saf, vitess, py3-captum, npm, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, haraka, kibana, prism...

GHSA-G8M3-5G58-FQ7M vulnerabilities

Vulnerabilities for packages: gemini-cli, actions-runner, renovate, code-server, node-gyp, pelias-api, saf, vitess, py3-captum, npm, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, haraka, kibana, prism...

GHSA-P88M-4JFJ-68FV vulnerabilities

Vulnerabilities for packages: gemini-cli, actions-runner, renovate, code-server, node-gyp, pelias-api, saf, vitess, py3-captum, npm, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, haraka, kibana, prism...

PT-2026-55664

Summary A multi‑stage chain in motionEye leads to remote code execution. The chain combines: 1. Arbitrary file read LFI via the picture download endpoint for local motion cameras using absolute paths. 2. Pass‑the‑hash admin auth due to accepting request signatures computed with password hashes. 3...

CVE-2026-54007: Origin Validation Error

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim...

CVE-2026-56115: Missing Authorization

Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the recordSelectOptionsQuery method. An attacker can bypass intended access restrictions by tampering with the Livewire component's state and submitting out-of-scope values in the Sele...

CVE-2026-48067

Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery method may be used to scope the options available in the Select field for AttachActio...

CVE-2026-48067 Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields

Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery method may be used to scope the options available in the Select field for AttachActio...

CVE-2026-48067

CVE-2026-48067 affects Filament components where the recordSelectOptionsQuery() used to scope options in AttachAction and AssociateAction Select fields did not apply the same scope in validation. From filament/actions 4.0.0–4.11.4 and 5.6.4, and filament/tables 3.0.0–3.3.51, an attacker could tri...

CVE-2026-48067

Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery method may be used to scope the options available in the Select field for AttachActio...

CVE-2026-56221 Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts

Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-controlled values from API request bodies are interpolated directly into SQL query strings without sanitization or parameterization. Authenticated users with read-level API key permissions can injec...

CVE-2026-10601

A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke...

OpenCTI May Bypass Introspection Restriction

Summary The regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed characters from the query. Details GraphQL Queries in OpenCTI can be validated using the secureIntrospectionPlugin. Impact Bypassing this restriction...

CVE-2026-56450

AIL did not restrict repeated failed attempts to verify a two-factor authentication OTP code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable...

EUVD-2026-38239

AIL did not restrict repeated failed attempts to verify a two-factor authentication OTP code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable...

CVE-2026-56450

AIL did not restrict repeated failed attempts to verify a two-factor authentication OTP code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable...