CVE-2026-13062: Unintended Proxy or Intermediary

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...

CVE-2026-13181: Use of Externally-Controlled Input to Select Classes or Code

In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments...

CVE-2026-13182: Generation of Error Message Containing Sensitive Information

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers...

PT-2026-63466

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with write privileges on a collection enabled with Queryable Encryption can modify internal encryption metadata fields that should be controlled by the server. This occu...

PT-2026-63396

Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708 Description The RadAsyncUpload component contains a flaw in client-state processing where the system can distinguish between decryption failures and invalid-JSON parse failures. This behavior...

CVE-2026-46997

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

CVE-2026-46998

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

CVE-2026-46995

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine internal/xds/rbac and the HTTP/2 transport server implementation internal/transport. These vulnerabilities could result in: - Authorization Bypass Fail-Open when translating...

GHSA-HRXH-6V49-42GF gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine internal/xds/rbac and the HTTP/2 transport server implementation internal/transport. These vulnerabilities could result in: - Authorization Bypass Fail-Open when translating...

TypeORM: migration:generate template-literal code injection

Summary typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not $.... An attacker who can write schema metadata column comments, defaults, view definitions achieves arbitrary code execution on the host that loads the generated migration...

Arbitrary Code Injection

Overview typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript ES5, ES6, ES7, ES8. Affected versions of this package are vulnerable to Arbitrary Code Injection in the...

GHSA-2RP8-MM9Q-FP49 TypeORM: migration:generate template-literal code injection

Summary typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not $.... An attacker who can write schema metadata column comments, defaults, view definitions achieves arbitrary code execution on the host that loads the generated migration...

Arbitrary Code Injection

Overview org.webjars.npm:typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript ES5, ES6, ES7, ES8. Affected versions of this package are vulnerable to Arbitrary Code...

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Summary Gitea has robust SSRF protection via hostmatcher.NewDialContext for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw http.Get Go's DefaultClient which completely bypasses this protection, enabling SSRF to internal...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Open function, which uses raw http.Get and os.Open without proper host or scheme validation. An attacker can access internal network resources, cloud metadata endpoints, or read arbitrary local...

Server-side Request Forgery (SSRF)

Overview code.gitea.io/gitea/services/migrations is a painless self-hosted Git Service. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Open function, which uses raw http.Get and os.Open without proper host or scheme validation. An attacker can access...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...