CVE-2026-69075

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...

EUVD-2026-52253

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...

CVE-2026-17346

CVE-2026-17346 affects pgAdmin 4 (Index Statistics sink for all-indexes listing in 1.0 and Publications/Subscriptions sinks in 5.0 prior to 9.17). The issue arose after CVE-2026-12044 fix: templates for sixteen COMMENT ON / pgstattuple / pgstatindex were hardened with qtLiteral, but several sinks...

GHSA-HR7P-WG7R-HG9M Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Summary The capability policy denies the env.get and env.loaddotenv modules by default, with the stated reason that they read arbitrary host environment variables API keys, DSNs and are a secret-exfil risk. But the workflow engine's variable resolver expands $env.VAR for any environment variable...

SUSE-SU-2026:3415-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues - CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. - CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a proce...

CVE-2026-54666

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping...

CVE-2026-54656

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in...

CVE-2026-14958

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...

CVE-2026-14958 OS command injection in IBM Aspera Faspex

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...

EUVD-2026-50057

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...

CVE-2026-14958

IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) is affected by a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation. The issue is a root cause in shell command handling that enables code execution with high impact (confide...

Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting

Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the...

CVE-2026-66396

SiYuan before v3.7.2 has a stored XSS in the Gallery/Kanban cover rendering due to failing to escape the title-img Individual Attribute List value. The unescaped style attribute interpolation allows onload handlers injected by an editor, enabling arbitrary code execution in the Electron renderer ...

EUVD-2026-44926

Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator...

CVE-2026-47722

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/configgen/generator.go:86,108,119 interpolates the operator-supplied ListenHost and TunDevice fields raw into a text/template that produces the agent's config.yml...

CVE-2026-47722 nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/configgen/generator.go:86,108,119 interpolates the operator-supplied ListenHost and TunDevice fields raw into a text/template that produces the agent's config.yml...

EUVD-2026-48381

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/configgen/generator.go:86,108,119 interpolates the operator-supplied ListenHost and TunDevice fields raw into a text/template that produces the agent's config.yml...

GHSA-HWMJ-QG4V-CVG9 n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

Impact The legacy MySQL v1 node's executeQuery operation substitutes evaluated ... expression values directly into the raw SQL string without parameterization. If a workflow uses this operation with expression-sourced values in the query and is connected to an externally-reachable trigger such as...

CVE-2026-47708 MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the logfilename parameter in the statado API and CLI is directly interpolated into a Stata command string without sanitization. The security guard GuardValidator only scans the do-file content but...

CVE-2026-49216

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in createAutocompleteWithRemoteData by interpolating the text field into HTML template literals $itemlabelField rather than text,...