Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

Summary The forced password-change flow, triggered when the stored password is still the default admin, does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditorpassword is enough to reach the password-change form, and...

GHSA-PMPG-2MXQ-6XWR Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like "email": " currentUser.email " so each app user only sees their own rows. Because the binding is...

Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like "email": " currentUser.email " so each app user only sees their own rows. Because the binding is...

Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Summary Budibase's MongoDB query execution endpoint POST /api/v2/queries/:queryId is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the...

GHSA-QW6M-8FW2-2V64 Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Summary Budibase's MongoDB query execution endpoint POST /api/v2/queries/:queryId is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the...

Open WebUI: Arena task endpoints can bypass underlying model access controls

Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...

GHSA-M3QF-58WF-W979 Open WebUI: Arena task endpoints can bypass underlying model access controls

Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...

CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, logstash, pghero-fips, kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset, pghero...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, logstash, pghero-fips, kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset, pghero...

CVE-2026-54171 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, cinc-auditor...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: kube-logging-operator, cinc-auditor...

GHSA-Q4F6-JM68-57WW vulnerabilities

Vulnerabilities for packages: celeborn, logstash, akhq, apache-activemq-artemis, kserve-modelmesh, apache-nifi, apache-pulsar, flyway, opensearch, tez, infinispan, apicurio-registry, druid, thingsboard, zipkin, cloudwatch-exporter, spark, keycloak, management-api-for-apache-cassandra-5.0,...

CVE-2026-56746 vulnerabilities

Vulnerabilities for packages: celeborn, logstash, akhq, apache-activemq-artemis, kserve-modelmesh, apache-nifi, apache-pulsar, flyway, opensearch, tez, infinispan, apicurio-registry, druid, thingsboard, zipkin, cloudwatch-exporter, spark, keycloak, management-api-for-apache-cassandra-5.0,...

GHSA-6CQP-G7GG-8HR5 vulnerabilities

Vulnerabilities for packages: celeborn, logstash, akhq, apache-activemq-artemis, kserve-modelmesh, apache-nifi, apache-pulsar, flyway, opensearch, tez, infinispan, apicurio-registry, druid, thingsboard, zipkin, cloudwatch-exporter, spark, keycloak, management-api-for-apache-cassandra-5.0,...

GHSA-6JQX-86GH-F27W vulnerabilities

Vulnerabilities for packages: celeborn, logstash, akhq, apache-activemq-artemis, kserve-modelmesh, apache-nifi, apache-pulsar, flyway, opensearch, tez, infinispan, apicurio-registry, druid, thingsboard, zipkin, cloudwatch-exporter, spark, keycloak, management-api-for-apache-cassandra-5.0,...

GHSA-4MP9-239F-G9HG vulnerabilities

Vulnerabilities for packages: celeborn, logstash, akhq, apache-activemq-artemis, kserve-modelmesh, apache-nifi, apache-pulsar, flyway, opensearch, tez, infinispan, apicurio-registry, druid, thingsboard, zipkin, cloudwatch-exporter, spark, keycloak, management-api-for-apache-cassandra-5.0,...

CVE-2026-59899 vulnerabilities

Vulnerabilities for packages: celeborn, logstash, akhq, apache-activemq-artemis, kserve-modelmesh, apache-nifi, apache-pulsar, flyway, opensearch, tez, infinispan, apicurio-registry, druid, thingsboard, zipkin, cloudwatch-exporter, spark, keycloak, management-api-for-apache-cassandra-5.0,...

CVE-2026-55831 vulnerabilities

Vulnerabilities for packages: celeborn, logstash, akhq, apache-activemq-artemis, kserve-modelmesh, apache-nifi, apache-pulsar, flyway, opensearch, tez, infinispan, apicurio-registry, druid, thingsboard, zipkin, cloudwatch-exporter, spark, keycloak, management-api-for-apache-cassandra-5.0,...

CVE-2026-59898 vulnerabilities

Vulnerabilities for packages: celeborn, logstash, akhq, apache-activemq-artemis, kserve-modelmesh, apache-nifi, apache-pulsar, flyway, opensearch, tez, infinispan, apicurio-registry, druid, thingsboard, zipkin, cloudwatch-exporter, spark, keycloak, management-api-for-apache-cassandra-5.0,...

MAL-2026-11054 Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...