14583 matches found
CVE-2026-110867
Versions of Renovate prior to 44.60.1 are vulnerable to an allowlist bypass where repositories can set restricted environment variables by embedding them within a shared preset . An attacker who controls an externally sourced preset can override critical environment variables, such as PATH , LD_P...
CVE-2026-110867 Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LDPRELOAD, NODEOPTIONS, or GITSSLCAINFO i...
CVE-2026-110867 Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LDPRELOAD, NODEOPTIONS, or GITSSLCAINFO i...
CVE-2026-110867 Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LDPRELOAD, NODEOPTIONS, or GITSSLCAINFO i...
CVE-2026-110865 Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules.headers to inject cust...
CVE-2026-110865
Versions of Renovate before 44.60.1 are vulnerable to an HTTP Header Allowlist Bypass via shared presets. The root cause is the failure to validate hostRules[].headers within shared presets, allowing users to evade allowedHeaders restrictions. Attackers can provide internal or external presets to...
CVE-2026-110850 n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters
n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to...
CVE-2026-110850
The n8n workflow automation tool is vulnerable in versions before 2.41.4 and 2.42.0 before 2.42.1 due to a Credential Check Bypass . The root cause is that the system fails to validate credential IDs stored within agent node parameters when an editor saves a shared workflow, as the security check...
CVE-2026-61843
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and an...
CVE-2026-61843 FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and an...
CVE-2026-55498
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An...
EUVD-2026-101626
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An...
CVE-2026-55498 FileRise Shared Folder Symlink Escape
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An...
CVE-2026-55498
Versions of FileRise prior to 3.15.0 are vulnerable to a symbolic link path traversal issue. When public shared-folder links with subfolder browsing are enabled, the application fails to enforce the shared folder as a real-path boundary when resolving symlinks. Consequently, an unauthenticated at...
CVE-2026-55498 FileRise Shared Folder Symlink Escape
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An...
GHSA-M6WQ-39M7-9XPP Metalama allows local code execution through DLL planting in shared temporary directories
Summary Metalama loaded and executed compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. On Linux and macOS the default cache location was the world-writable system temporary directory Path.GetTempPath, i.e. /tmp, and...
Metalama allows local code execution through DLL planting in shared temporary directories
Summary Metalama loaded and executed compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. On Linux and macOS the default cache location was the world-writable system temporary directory Path.GetTempPath, i.e. /tmp, and...
CVE-2026-102695
OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...
CVE-2026-102695 OmniFaces: Forged combined-resource IDs and related output/push boundaries
OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...
CVE-2026-102695
OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...