GHSA-XHHM-F6HP-2QWJ djust has an authorization bypass on the WebSocket/SSE mount path

Impact The live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @methoddecoratorloginrequired, name="dispatch", and custom dispatch guards — a...

djust has an authorization bypass on the WebSocket/SSE mount path

Impact The live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @methoddecoratorloginrequired, name="dispatch", and custom dispatch guards — a...

CVE-2026-92599 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-secon...

CVE-2026-92599

joi (npm package, hapi.js) versions >=17.2.0 =18.0.0

CVE-2026-92599 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-secon...

CVE-2026-92595

Nodemailer (npm package nodemailer) versions 9.1.0 and earlier fail to honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved via the public plugin API MailMessage.resolveContent() using the legacy three-argument signature. The root cause is that shared....

CVE-2026-92595 Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent

Nodemailer npm package nodemailer versions 9.1.0 and earlier do not honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent using the documented legacy three-argument signature resolveContentdata,...

CVE-2026-92595 Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent

Nodemailer npm package nodemailer versions 9.1.0 and earlier do not honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent using the documented legacy three-argument signature resolveContentdata,...

CVE-2026-92588 n8n before 1.123.76 Improper Authorization via Source Control Push

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting...

CVE-2026-92588 n8n before 1.123.76 Improper Authorization via Source Control Push

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting...

CVE-2026-92588 n8n before 1.123.76 Improper Authorization via Source Control Push

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting...

CVE-2026-92588

n8n is a workflow automation platform. In versions before 1.123.76 , 2.37.7 , and 2.38.2 , the source control push endpoint derived the set of files to push from client-supplied file paths and status rather than from server-side status computed for the requesting user. An authenticated project-sc...

CVE-2026-92580 AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

CVE-2026-92580 AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

CVE-2026-92580

AVideo through 29.0 in the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (~line 270), the stored SSH password is substituted into the command sshpass -p '{password}' rsync ... via a plain str_replace with no escaping, so a single quote bre...

CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection

CVE-2025-67644 PoC – LangGraph SQLite Checkpoint SQL Injection CVE-2025-67644 is a SQL Injection vulnerability CWE-89 in the langgraph-checkpoint-sqlite package part of LangGraph / LangChain ecosystem. It allows an attacker to inject arbitrary SQL via unsanitized metadata filter keys passed to th...

CVE-2026-92816

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

CVE-2026-92806

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...

CVE-2026-92793

GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative...

CVE-2026-81871

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...