CVE-2026-93985

OpenPanel js-runtime through commit bad75bdd is affected by a sandbox escape in its JavaScript webhook template validator . The validator fails to block computed member access to constructor chains, allowing attackers with project write access to craft webhook templates using computed property no...

CVE-2026-93985 OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access...

CVE-2026-61821

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, droppartitionid and droppartitiontime use partconfig.retentionschema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partmanuser access can select a target...

EUVD-2026-83425

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, droppartitionid and droppartitiontime use partconfig.retentionschema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partmanuser access can select a target...

CVE-2026-61821 pg_partman authorization bypass to move child tables between schemas during retention

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, droppartitionid and droppartitiontime use partconfig.retentionschema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partmanuser access can select a target...

CVE-2026-93596

ArcadeDB before 26.9.1 com.arcadedb:arcadedb-engine outedges/inedges buckets, resulting in unauthorized modification of graph adjacency. Setting parallelFlush=false causes the request to be correctly rejected. This is an incomplete fix of GHSA-c23x-pqcj-7hfm, which bound the principal only on the...

CLEANSTART-2026-YJ99527 Security fix for ghsa-6475-r3vj-m8vf applied in: langfuse 3.146.0-r1, langfuse-worker 3.146.0-r1, opensearch-dashboards-fips 3.5.0-r1

ghsa-6475-r3vj-m8vf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RO11754 Security fix for CVE-2026-69198 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r1, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1, langfuse-worker 3.224.1-r1, langfuse-worker 3.224.2-r1, langfuse-worker 3.224.4-r1, langfuse-worker 3.225.0-r1, langfuse-worker 4.0.0-r1, langfuse-worker 4.3.0-r1, langfuse-worker 4.3.1-r1, n8n 2.28.0-r2, npm 11.17.0-r2, npm 11.18.0-r2, proxy-agent 6.4.0-r0, proxy-agent 6.5.0-r1, proxy-agent 7.0.0-r2, proxy-agent 8.0.2-r1, renovate 44.31.0-r2, renovate 44.32.4-r1, renovate 44.32.5-r1, renovate 44.32.6-r1

CVE-2026-69198 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HB04521 Security fix for CVE-2026-54272 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r1, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1, langfuse-worker 3.224.1-r1, langfuse-worker 3.224.2-r1, langfuse-worker 3.224.4-r1, langfuse-worker 3.225.0-r1, langfuse-worker 4.0.0-r1, langfuse-worker 4.3.0-r1, langfuse-worker 4.3.1-r1, n8n 2.28.0-r2, npm 11.17.0-r2, npm 11.18.0-r2, proxy-agent 6.4.0-r0, proxy-agent 6.5.0-r1, proxy-agent 7.0.0-r2, proxy-agent 8.0.2-r1, renovate 44.31.0-r2, renovate 44.32.4-r1, renovate 44.32.5-r1, renovate 44.32.6-r1

CVE-2026-54272 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AE26966 Security fix for CVE-2026-69152 applied in: argo-workflows 3.6.19-r7, langfuse-worker 3.224.0-r3, langfuse-worker 3.224.1-r2, langfuse-worker 3.224.2-r3, langfuse-worker 3.224.4-r1, langfuse-worker 3.225.0-r2, langfuse-worker 4.0.0-r2, langfuse-worker 4.3.0-r1, n8n 2.28.0-r2, npm 11.17.0-r2, npm 11.18.0-r2, npm 11.18.0-r4, pulumi 3.248.0-r0, renovate 44.31.0-r3, renovate 44.32.4-r1, renovate 44.32.5-r1, renovate 44.32.6-r1

CVE-2026-69152 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WV03334 Security fix for ghsa-r28c-9q8g-f849 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r2, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1, langfuse-worker 3.224.1-r2

ghsa-r28c-9q8g-f849 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WU05348 Security fix for CVE-2026-69153 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r2, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1, langfuse-worker 3.224.1-r2, langfuse-worker 3.224.2-r1, langfuse-worker 3.224.4-r1, langfuse-worker 4.0.0-r1, langfuse-worker 4.3.0-r1, langfuse-worker 4.3.1-r2, n8n 2.28.0-r2

CVE-2026-69153 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PJ45513 Security fix for CVE-2026-73420 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r2, langfuse-worker 3.223.0-r2

CVE-2026-73420 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PL55770 Security fix for CVE-2026-73418 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r2, langfuse-worker 3.223.0-r2

CVE-2026-73418 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HJ83512 Security fix for CVE-2026-73419 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r2, langfuse-worker 3.223.0-r2

CVE-2026-73419 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JW21689 Security fix for ghsa-x445-f3h2-j279 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r2, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1

ghsa-x445-f3h2-j279 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KD45658 Security fix for ghsa-xmf8-cvqr-rfgj applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r2, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1

ghsa-xmf8-cvqr-rfgj affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UY65626 Security fix for ghsa-7rqj-j65f-68wh applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r2, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1

ghsa-7rqj-j65f-68wh affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VV35394 Security fix for CVE-2026-71438 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r1, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1, langfuse-worker 3.224.1-r1, langfuse-worker 3.224.2-r1, langfuse-worker 3.224.4-r1, langfuse-worker 4.0.0-r1, langfuse-worker 4.13.0-r1, langfuse-worker 4.7.0-r1, langfuse-worker 4.7.1-r1

CVE-2026-71438 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VU48904 Security fix for CVE-2026-71439 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r1, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1, langfuse-worker 3.224.1-r1, langfuse-worker 3.224.2-r1, langfuse-worker 3.224.4-r1, langfuse-worker 4.0.0-r1, langfuse-worker 4.13.0-r1, langfuse-worker 4.7.0-r1, langfuse-worker 4.7.1-r1

CVE-2026-71439 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...