CVE-2026-74789

Scriban before 7.0.0 (affected

CVE-2026-74788

CVE-2026-74788 affects Scriban before 7.0.0 (affected versions ≤ 6.6.0). The vulnerability resides in the template functions string.pad_left and string.pad_right , which do not validate the width parameter before delegating to .NET’s String.PadLeft/PadRight. An attacker can supply an extremely la...

CVE-2026-74787

Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that ...

CVE-2026-74786

CVE-2026-74786 affects Scriban before 7.0.0 (versions

CVE-2026-74785

Scriban before 7.0.0 contains three denial-of-service vulnerabilities in expression evaluation: unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attackers who can supply templates can trigger out-of-memory ...

CVE-2026-74784

Scriban before 7.2.0 exposes a Denial of Service via array.insert_at. The vulnerability allocates unbounded null entries when given a large index, ignoring LoopLimit and LimitToString constraints, causing OutOfMemoryException and crashing the host process in under a second. Affected component: Sc...

CVE-2026-74783

CVE-2026-74783 affects Scriban versions 6.6.0 through 7.2.0. The issue is a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, o...

CVE-2026-73062

The CVE-2026-73062 entry affects Scriban 3.0.0 through 7.2.0, where the array multiplication operator allocates memory without enforcing LoopLimit or overflow-safe checks. An attacker can supply a large integer multiplier in a template to trigger multi-gigabyte memory allocations, leading to reso...

CVE-2026-73061

Scriban before 7.2.2 has an access-modifier bypass in TypedObjectAccessor, allowing template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters and mass-assign public-setter properties, permanently alt...

CVE-2026-73060

Scriban versions 3.0.0–7.2.5 have a denial-of-service vulnerability in ScriptRange.Multiply where the left operand is a lazy sequence, bypassing LoopLimit. Attackers can craft templates that multiply arrays on lazy sequences to trigger billions of uncharged iterations, pinning CPU cores and exhau...

CVE-2026-73059

Stoatchat before 0.15.0 contains a permission bypass in the message_fetch route that checks only ViewChannel instead of requiring ReadMessageHistory. Attackers with ViewChannel but without ReadMessageHistory can retrieve individual message content by ID, bypassing history restrictions on bulk rea...

CVE-2026-73058

Stoatchat before 0.15.0 is affected by an SSRF bypass: the IPv6 unspecified address (::) is not blocked, allowing unauthenticated attackers to access internal content via /proxy and /embed. The issue permits crafting IPv6 literal requests to reach loopback services; no exploitation details are pr...

CVE-2026-73057

CVE-2026-73057 affects stoatchat before 0.15.0. The vulnerability is in the SVG rendering within the proxy endpoint, where viewBox dimensions are not validated. An attacker can host malicious SVGs with extremely large width/height values and trigger concurrent requests, causing memory exhaustion ...

CVE-2026-73056

SiYuan kernel versions prior to 3.7.4 are affected by an unthrottled brute-force vulnerability in CheckAuth() that allows unauthenticated remote attackers to repeatedly guess the API token (via Authorization header or ?token=) without CAPTCHA/lockout, potentially gaining full RoleAdministrator ac...

CVE-2024-58375

OpenTofu 1.8.0–1.8.2 do not properly restrict sensitive variables/locals when static evaluation is enabled, allowing potential leakage of values marked as sensitive through configuration elements. The issue is resolved in OpenTofu 1.8.3, which adds explicit errors to prevent use of sensitive valu...

CVE-2026-74251

The CVE affects Phoca Cart (Phoca.cz) on Joomla, specifically versions 5.0.0–6.1.16. The vulnerability is an unauthenticated SQL injection where a[] (attribute) and s[] (specification) GET parameters from Phoca Cart’s public shop items page are concatenated directly into SQL WHERE clauses without...

CVE-2024-13784

The CVE-2024-13784 entry concerns the WordPress plugin ARForms (Contact Form, Survey, Quiz & Popup Form Builder). Affected versions: all up to and including 1.8.5. Root cause: PHP Object Injection via deserialization of untrusted input from form submissions. Impact requires that a POP chain exist...

CVE-2026-74578

CVE-2026-74578 affects the Linux kernel crypto/algif_skcipher path. The AIO/async path in skcipher_recvmsg() could expose an attacker-controlled IV by overwriting ctx->iv via concurrent ALG_SET_IV writes, enabling IV/keystream reuse for CTR/stream modes and potentially plaintext recovery of co...

CVE-2026-17604

The CVE (CVE-2026-17604) affects the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. All versions up to 6.1.1 are vulnerable to Directory Traversal via the data parameter. Authentication with at least editor-level access is required, enabling an attacker to read arbi...

CVE-2026-18347

Summary: CVE-2026-18347 affects the Kirki WordPress plugin (Freeform Page Builder, Website Builder & Customizer) up to version 6.1.1. The root cause is an authorization bypass where the plugin fails to verify that a user is allowed to perform an action. Impact: authenticated attackers with custom...