OpenMetaData - SpEL Injection in PUT /api/v1/policies

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. CompiledRule::validateExpression is also called from PolicyRepository.prepare. prepare is called from...

CVE-2026-81769

Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1...

EUVD-2026-69927

Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1...

PT-2026-84688

Name of the Vulnerable Software and Affected Versions Booking Hub versions prior to 1.3.2 Description An incorrect privilege assignment issue allows users with Subscriber roles to perform privilege escalation. Recommendations Update to a version newer than 1.3.1...

PT-2026-79114

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...

CVE-2026-65572 WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...

CVE-2026-65572

The CVE-2026-65572 entry concerns the WordPress A.Williams theme (versions

EUVD-2026-53990

Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...

WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme A.Williams versions = 1.3.1...

CVE-2026-48121

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

CVE-2026-48121

The CVE-2026-48121 vulnerability affects @langchain/langgraph-checkpoint-mongodb (MongoDBSaver) and involves NoSQL parameter injection in MongoDB queries. Versions 1.3.0 and earlier pass checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable directly into MongoD...

CVE-2026-48121 @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

CVE-2026-48121 @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

CLSA-2026-1784596275 TuxCare security update for http-proxy-middleware (3 CVEs)

TuxCare rebuilt http-proxy-middleware to address 3 CVEs. Fixed in 1.3.1-tuxcare.1...

CLSA-2026-1780447839 TuxCare security update for dns-packet (1 CVE)

TuxCare rebuilt dns-packet to address 1 CVE. Fixed in 1.3.1-tuxcare.1...

CLSA-2026-1778805969 TuxCare security update for lodash (1 CVE)

TuxCare rebuilt lodash to address 1 CVE. Fixed in 1.3.1-tuxcare.2...

PYSEC-2026-3574 gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

Summary consultgeminiwithfiles in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip and...

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

Summaryconsultgeminiwithfiles in inline mode read any file path supplied inthe files argument without confining it to the working directory, thenforwarded the contents to the Gemini CLI. Because the caller also controlsquery, the file contents are echoed back through the Gemini round-tripand sent...

CVE-2026-54785

gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consultgeminiwithfiles in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to th...

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

Summary consultgeminiwithfiles in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip and...