@biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14), @blinkk/root-cms (>=3.5.2, <=4.1.2) +129 more potentially affected by CVE-2026-113657 via sanitize-html (2.17.7)

sanitize-html NPM version 2.17.7 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @biztory/n8n-nodes-tableau-rest-api =0.1.13, =3.5.2, =12.3.0-depup.0, =39.0.0, =9.0.2, =0.0.0-dummy.1, =0.29.2, =0.1.0, =0.10.2,...

@biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14), @blinkk/root-cms (>=3.5.2, <=4.1.2) +129 more potentially affected by CVE-2026-113657 via sanitize-html (2.17.7)

sanitize-html NPM version 2.17.7 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @biztory/n8n-nodes-tableau-rest-api =0.1.13, =3.5.2, =12.3.0-depup.0, =39.0.0, =9.0.2, =0.0.0-dummy.1, =0.29.2, =0.1.0, =0.10.2,...

GHSA-VMXH-77CW-65J7 ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

Summary ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorizati...

ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

Summary ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorizati...

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

Summary The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving ...

CVE-2026-113670

Rejected reason: This CVE is a duplicate of another CVE...

CVE-2026-113660

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized...

GHSA-2J32-Q6RX-H844 ApostropheCMS: Page REST API authorization bypass

Summary The core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public...

ApostropheCMS: Page REST API authorization bypass

Summary The core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public...

npm: ApostropheCMS: Page REST API authorization bypass

npm: ApostropheCMS: Page REST API authorization bypass vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

CVE-2026-97406 Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials...

CVE-2026-97406

The Xerj Console API , an open-source search and indexing engine, contains an authentication bypass vulnerability (CVE-2026-97406 ). The root cause is an architectural flaw where the system fails to distinguish between standard browser sessions and API bearer tokens, converting both into a generi...

EUVD-2026-105251

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials...

EUVD-2026-105250

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...

CVE-2026-113708 Argo CD: A Kustomize remote ref can run commands in the repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...

EUVD-2026-105249

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...

CVE-2026-113672 Argo CD: A Jsonnet import can read files from the repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory...

CVE-2026-93856

A flaw was found in OpenStack Cinder. An authenticated user with project-level access can retrieve messages intended for other projects by issuing a message listing request to the Block Storage API. This flaw leads to information disclosure, exposing resource identifiers and status messages...

CVE-2026-113670

...

EUVD-2026-105219

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated...