Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

Summary Algernon selects its file handler from filepath.Ext engine/handlers.go:134, which does not treat the NTFS-equivalent names x.lua::$DATA, x.lua., or x.lua as .lua. On Windows, an unauthenticated client appends one of these suffixes to any server-side script on a public path and receives it...

GHSA-MM6C-5J6X-HQ8M Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

Summary Algernon selects its file handler from filepath.Ext engine/handlers.go:134, which does not treat the NTFS-equivalent names x.lua::$DATA, x.lua., or x.lua as .lua. On Windows, an unauthenticated client appends one of these suffixes to any server-side script on a public path and receives it...

CVE-2026-7311

creationtimestamp| type| source ---|---|--- 2026-07-02 20:16:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpotyblujl2q 2026-07-02 22:03:09+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpozwmi2ca2g 2026-07-03 12:16:06+00:00| seen|...

CVE-2026-5348

creationtimestamp| type| source ---|---|--- 2026-07-02 20:07:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoth3xfxh2o...

CVE-2026-58465

creationtimestamp| type| source ---|---|--- 2026-07-02 19:50:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mposkbdi6n2z 2026-07-02 22:01:24+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpoztjb2lr27 2026-07-03 12:15:44+00:00| seen|...

CVE-2026-28322

creationtimestamp| type| source ---|---|--- 2026-07-02 19:37:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mporrnzimn22...

Security Bulletin: Parameter Injection Vulnerability in API Graph Execution Engine

Summary A parameter injection vulnerability existed in the API Graph Execution Engine's tweaks processing mechanism. The vulnerability allowed authenticated attackers to bypass security controls and inject malicious parameters into flow components at runtime. An attacker with valid API credential...

CVE-2026-55950

creationtimestamp| type| source ---|---|--- 2026-07-02 19:30:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mporghjrir27 2026-07-03 09:41:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqaxqaleg2u 2026-07-03 10:37:35+00:00| seen|...

Security Bulletin: Remote Code Execution in CUGA Component CodeAgent

Summary An authenticated user could execute arbitrary commands on the server when the CUGA component is installed and a flow using CUGA's CodeAgent is created and executed. The vulnerability exists in the CodeAgent's Python code execution path, which permits object graph introspection to recover...

CVE-2026-55952

creationtimestamp| type| source ---|---|--- 2026-07-02 19:21:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpoqvtlhjo2o 2026-07-03 08:38:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq5hhbt5t2n 2026-07-03 09:42:35+00:00| seen|...

CVE-2026-7387

creationtimestamp| type| source ---|---|--- 2026-07-02 19:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpoq3tfzwi2l...

CVE-2026-55117

creationtimestamp| type| source ---|---|--- 2026-07-02 19:06:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpoq2bxh2s2b 2026-07-03 08:31:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq52sxpo22q 2026-07-08 11:01:21+00:00| seen|...

CVE-2026-55119

creationtimestamp| type| source ---|---|--- 2026-07-02 18:56:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpopif3kwk2a 2026-07-03 07:27:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppzgy6epo2n 2026-07-08 11:01:21+00:00| seen|...

CVE-2026-55110

creationtimestamp| type| source ---|---|--- 2026-07-02 18:51:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpop7glvx22w 2026-07-03 07:07:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppydky5l42i 2026-07-08 11:01:21+00:00| seen|...

EUVD-2026-41154

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement...

GHSA-QH45-9G5P-M2V4 Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

We have identified an authorization issue in Craft CMS AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId. Description Craft CMS’s craft\controllers\AssetsController::actionReplaceFile supports replacing...

CVE-2026-55118

creationtimestamp| type| source ---|---|--- 2026-07-02 18:43:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpoor235rc2w 2026-07-03 07:25:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppzez46vy2o 2026-07-03 08:39:20+00:00| seen|...

CVE-2026-55113

creationtimestamp| type| source ---|---|--- 2026-07-02 18:39:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpool2ytca2n 2026-07-03 07:17:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppyvas46o27 2026-07-08 11:01:21+00:00| seen|...

CVE-2026-55116

creationtimestamp| type| source ---|---|--- 2026-07-02 18:31:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpoo4atcsr2w 2026-07-03 08:31:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq4zlwqt52c 2026-07-03 21:38:06+00:00| seen|...

CVE-2026-55111

creationtimestamp| type| source ---|---|--- 2026-07-02 18:25:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mponqlwrdj2m 2026-07-03 07:08:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppyfkkhz32m 2026-07-08 11:01:21+00:00| seen|...