CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85589

phpMyFAQ before 4.2.0-alpha.2 is affected by a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health. These endpoints enforce only authentication but omit permission checks, allowing any authenticated user—regardless of privilege level—to read site-w...

EUVD-2026-70212

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-linode, grpcurl, ferretdb, crossplane-provider-aws-iam, fluxcd-kustomize-mutating-webhook, spire-controller-manager, gitleaks, nri-mongodb, local-path-provisioner, vault-k8s, paranoia, timescaledb-parallel-copy, crossplane-provider-sql,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy, dive, spire-controller-manager, nova, cluster-api-provider-vsphere, kubernetes-csi-driver-nfs, mockgen, rabbitmq-messaging-topology-operator, containerd, wait-for-port, libnvidia-container, nginx-prometheus-exporter, nri-consul,...

CLEANSTART-2026-XV94237 Security fixes in kubernetes-dashboard-api 1.14.0-r1

Package kubernetes-dashboard-api version 1.14.0-r1 fixes 27 vulnerabilities: ghsa-pc3f-x583-g7j2, CVE-2026-35469, CVE-2026-39820, CVE-2026-25679, CVE-2026-27143...

PYSEC-2026-2381 AstrBot has Incomplete Filtering of Special Elements

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function createtemplate of the file astrbot/dashboard/routes/t2i.py of the component Dashboard API. The manipulation results in improper neutralization of special elements used in a template engine. The atta...

CVE-2026-12593

The implementation of an internal and undocumented Dashboard API endpoint POST /api/users//user/tokens forgot to ensure an HTTP request for creating an API Token for another user had sufficient permission to do so. Precondition for successful exploitation was a preexisting internal user with more...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via improper handling of user-supplied input in the generateCronTriggerCronJobSpec process. An attacker can execute arbitrary shell commands with root privileges in the CronJob pod by injecting malicious content into...

GHSA-JPHH-M39H-6GWX 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

Summary 9router uses a publicly known hardcoded string "9router-default-secret-change-me" as the fallback of JWT secret for all Dashboard session JWTs when the JWTSECRET environment variable is not set. Because this secret is committed in the public repository and unchanged across all releases, a...

GHSA-W2Q5-6Q6X-X959 vulnerabilities

Vulnerabilities for packages: scuttle-fips, kserve-localmodelnode-agent-fips, kubernetes-dashboard-metrics-scraper, neuvector-dbgen-fips, ratify-fips, kubevirt-cdi-operator, apko-fips, aws-otel-collector-fips, prometheus-nats-exporter-fips, crossplane-provider-aws-kms, mapotf-fips,...

GHSA-H3RR-9WQJ-V3C6 AstrBot has Incomplete Filtering of Special Elements

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function createtemplate of the file astrbot/dashboard/routes/t2i.py of the component Dashboard API. The manipulation results in improper neutralization of special elements used in a template engine. The atta...

CVE-2026-6984

AstrBotDevs AstrBot up to version 4.22.1 contains a vulnerability in the Dashboard API, specifically in the create_template function (astrbot/dashboard/routes/t2i.py). The issue is improper neutralization of special elements used in the template engine, enabling remote execution. Public exploit i...

EUVD-2026-25660

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function createtemplate of the file astrbot/dashboard/routes/t2i.py of the component Dashboard API. The manipulation results in improper neutralization of special elements used in a template engine. The atta...

CVE-2026-40089

Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery SSRF vulnerability in its API client apps/dashboard/lib/api.ts. Installations created using the provided install.sh script includi...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-linode, k8sgpt-operator, argocd-image-updater, grpcurl, cloud-sql-proxy, spire-controller-manager, argo-workflows, terraform-provider-tls, cluster-api-provider-vsphere, crossplane-provider-sql, kubernetes-csi-driver-nfs, fscrypt,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-linode, k8sgpt-operator, argocd-image-updater, grpcurl, cloud-sql-proxy, spire-controller-manager, argo-workflows, terraform-provider-tls, cluster-api-provider-vsphere, crossplane-provider-sql, kubernetes-csi-driver-nfs, fscrypt,...

CVE-2026-40089 Sonicverse has Server-Side Request Forgery via user-controlled URLs in dashboard API client

Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery SSRF vulnerability in its API client apps/dashboard/lib/api.ts. Installations created using the provided install.sh script includi...

PT-2026-31718

Name of the Vulnerable Software and Affected Versions Sonicverse versions prior to commit cb1ddbacafcb441549fe87d3eeabdb6a085325e4 Description The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery SSRF vulnerability in its API client apps/dashboard/lib/api.ts...