EUVD-2026-54232

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...

CVE-2026-64665 Statamic: Account takeover via OAuth email matching without email-verification check

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...

CVE-2026-64664

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

EUVD-2026-54231

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

CVE-2026-45414 Decidim: JWT-backed authentication can be replayed across organizations

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read...

EUVD-2026-54227

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...

CVE-2026-71433

CVE-2026-71433 affects LangGraph checkpoint stores for Postgres and SQLite. Before 3.1.1, langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite persisted hierarchical namespaces as a dot-joined string and used a simple prefix match for reads, allowing an authenticated caller to access ite...

CVE-2026-71433

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...

EUVD-2026-54224

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...

CVE-2026-48071

OpenReception's appointment booking software (prior to version 1.0.4) has a vulnerability in the PIN-type challenge throttle. The throttle uses emailHash as the single key, with throttle rows stored in a shared central challenge_throttle table across tenants. As a result, failing challenges in on...

CVE-2026-48071 OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...

CVE-2026-64655 GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

CVE-2026-64654 GitHub CLI: Terminal escape sequence injection in multiple `gh` commands

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

EUVD-2026-54217

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANTADMIN of that tenant, including the databaseUrl field. This field contains...

CVE-2026-65400

An authentication bypass in the screensharingd daemon on macOS allows a network attacker to authenticate to Screen Sharing without valid credentials. The vulnerability stems from a stale success status returned by the SRP (Secure Remote Password) frame-length validator, meaning the connection is ...

CVE-2026-19065 SourceCodester Online Examination & Learning Management System upload_files.php unrestricted upload

A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file uploadfiles.php. This manipulation causes unrestricted upload. The attack may be initiated remotely...

EUVD-2026-54214

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

CVE-2026-64653 GitHub CLI: Unescaped variable components in request URLs could allow path traversal

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resourc...

CVE-2026-64653

CVE-2026-64653 affects GitHub CLI (gh) prior to version 2.97.0, where certain HTTP request URLs interpolated unescaped variable path components, enabling path traversal to targeted API endpoints or resources. The underlying issue is in how path components were incorporated into requests without p...

@cmmv/ai (0.0.5), @graphql-mesh/neo4j (>=0.103.0, <=0.106.2) +2 more potentially affected by CVE-2026-5423 via @neo4j/graphql (6.6.4)

@neo4j/graphql NPM version 6.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on @neo4j/graphql and may be impacted: - @cmmv/ai 0.0.5 - @graphql-mesh/neo4j =0.103.0, =0.7.13-alpha-20241031110808-e6f493d3529c46de0c7c0358ed1e2b5942f2a2a2, =0.7.0, =0.10.2...