Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ListArchivedWorkflows handler in server/workflowarchive/archivedworkflowserver.go. An attacker can read archived workflows from other namespaces by sending a metadata.namespace!=...

CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

EEF-CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector

Summary Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

GHSA-J6MJ-V752-PP4X Duplicate Advisory: SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rw6-p7m8-63jp. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements field. for record users...

WordPress plugin BP Profile Search 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2024-38627

Name of the Vulnerable Software and Affected Versions BP Profile Search plugin for WordPress versions up to, and including, 5.7.5 Description The issue is due to missing or incorrect nonce validation on the bps ajax field selector, bps ajax template options, and bps ajax field row functions. This...