CVE-2026-81719

opensslencrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...

CVE-2026-81097

The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...

EUVD-2026-67057

opensslencrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths...

EUVD-2026-67025

The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...

CVE-2026-81097

rails-mcp-server (versions 1.4.0 through 1.6.0 ) contains an OS command execution vulnerability in the execute_ruby tool. The tool is documented as a read-only Ruby sandbox enforced by a pattern denylist and replacements for process-spawning methods on Kernel , but the pseudo-terminal library's s...

CVE-2023-43208

CVE-2023-43208 — Mirth Connect RCE Pre-Autenticazione Esecuzione remota di codice pre-autenticata in NextGen Healthcare Mirth Connect CVSS 9.8 Critico — Bypass della patch di CVE-2023-37679 Panoramica Mirth Connect utilizza la libreria Java XStream per deserializzare payload XML sull'endpoint...

CVE-2026-76846

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

EUVD-2026-65224

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame. Attackers can supply revision values like --contents=/etc/passwd to leak...

CVE-2026-78678

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame. Attackers can supply revision values like --contents=/etc/passwd to leak...

CVE-2026-78678

GitPython versions prior to 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits the --contents and -S options. An attacker with low privileges can supply crafted revision values (e.g., --contents=/etc/passwd) to the Repo.blame() method, enabling arbitrary fil...

EUVD-2026-65220

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

CVE-2026-76846 Grav before 2.0.16 Information Disclosure via Twig Sandbox

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

CVE-2026-76846 Grav before 2.0.16 Information Disclosure via Twig Sandbox

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

PT-2026-81153

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An incomplete denylist in the unsafe git revision options guard fails to include the --contents and -S options. This allows an attacker to read arbitrary files by passing these options to the...

CVE-2026-71508

Dolibarr before 24.0.0 is affected by an improper authorization flaw in the user REST API update endpoint. The root cause is an incomplete credential denylist that omits payroll columns, allowing an attacker who holds only user-write rights (without payroll rights) to modify salary, bonus, hourly...

EUVD-2026-63912

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway...

CVE-2026-18356 Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway...

CVE-2026-18356

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 contains a bypass in its username denylist mechanism. The plugin fails to compare login attempts against the denylist case-insensitively and does not account for the account's email address , allowing an account that an administrator...

CVE-2026-72860 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

CVE-2026-75827

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...