CVE-2026-101085 Nezha before 2.3.8 Denial of Service via Alert Rule

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint t...

CVE-2026-101085

Versions of Nezha before 2.3.8 are vulnerable to a Denial of Service (DoS) because the software fails to validate alert rule types and duration bounds. Authenticated non-administrator users can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint, triggering unrecovered panics in ...

CVE-2026-101085 Nezha before 2.3.8 Denial of Service via Alert Rule

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint t...

CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-101048

Cloudreve versions before 4.17.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. The issue arises because the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) do not require the Admin.Write OAuth scope, unlike other node ma...

CVE-2026-97227

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social...

CVE-2026-89001

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user,...

CVE-2026-89001 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user,...

CVE-2026-89001

The WPeMatico RSS Feed Fetcher WordPress plugin, in versions before 2.8.27 , contains a vulnerability where it fails to verify if a user running a feed campaign has permission to publish content or attribute posts to other accounts. This allows users with contributor-level access and above to pub...

CVE-2026-89001 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user,...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the getValidUrl process in the webhook connector, which fails to properly validate hostnames and private IP ranges. An attacker can cause the server to send unauthorized HTTP POST requests to interna...

CVE-2026-100859

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

CVE-2026-100859

The Heym application (versions before 0.0.106 ) is vulnerable to a credential exfiltration flaw in the POST /api/credentials/test endpoint. The root cause is an URL override vulnerability where collaborators with shared credential access can manipulate the config parameter. By overriding the dest...

CVE-2026-100859 Heym before 0.0.106 Credential Exfiltration via URL Override

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

CVE-2026-100859 Heym before 0.0.106 Credential Exfiltration via URL Override

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

EUVD-2026-87824

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

PT-2026-99713

Name of the Vulnerable Software and Affected Versions Nezha versions prior to 2.3.8 Description Authenticated non-administrator users can create malformed alert rules due to a lack of validation for alert rule types and duration bounds. By submitting a crafted alert rule via the 'POST...

CVE-2026-100859: Server-Side Request Forgery (SSRF)

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

CVE-2026-101088: Time-of-check Time-of-use (TOCTOU) Race Condition

Nezha is a server and website monitoring tool. In versions = 2.2.11 and 2.3.1, the service sentinel worker service/singleton/servicesentinel.go contains an incomplete fix for a previously reported nil dereference denial of service GHSA-qjpp-gffx-2wm9. The 2026-07-21 fix re-validated the service...