CVE-2026-100703 Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

EUVD-2026-87676

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

CVE-2026-100703 Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

CVE-2026-100687

The Budibase Server (versions before 3.45.0 ) contains a vulnerability where it fails to redact plaintext datasource credentials when broadcasting external table updates to the Builder collaboration websocket room . An attacker with Builder access can intercept unredacted datasource objects, whic...

CVE-2026-100685

Budibase versions before 3.45.0 are vulnerable to an information disclosure flaw because the GET /api/chat-links endpoint fails to properly scope results by workspace. This oversight allows users with builder access to a single workspace to enumerate sensitive chat identity linking records—includ...

CVE-2026-100673 Grav Data Manager before 1.4.5 Stored XSS via item-detail view

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags'' call that PHP's striptags bypasses ...

CVE-2026-100673

The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The item-detail view (admin/templates/partials/item.html.twig) renders stored data entries without proper escaping by applying Twig's raw filter. ...

CVE-2026-100673 Grav Data Manager before 1.4.5 Stored XSS via item-detail view

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags'' call that PHP's striptags bypasses ...

EUVD-2026-87767

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags'' call that PHP's striptags bypasses ...

CVE-2026-100673 Grav Data Manager before 1.4.5 Stored XSS via item-detail view

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags'' call that PHP's striptags bypasses ...

EUVD-2026-87738

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100640 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100640 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100640 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100639 SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts from content pasted as plain-text Markdown containing a Kramdown inline attribute list IAL. Because the...

CVE-2026-100639 SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts from content pasted as plain-text Markdown containing a Kramdown inline attribute list IAL. Because the...

CVE-2026-100639 SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts from content pasted as plain-text Markdown containing a Kramdown inline attribute list IAL. Because the...

EUVD-2026-87726

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1-alpha.8, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not...

CVE-2026-100631

The open-source backend server Parse Server is vulnerable to an unauthenticated remote attack in versions prior to 8.6.90 and from 9.0.0 prior to 9.10.1-alpha.9 . The root cause is a failure to validate the type of client-supplied installation fields within the device token deduplication logic be...

CVE-2026-100610 Flowise through 3.1.4 Missing Authorization via upsert-history

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...