•30 minutes ago•GHSA-2RP4-X2J7-QMCC
8.2GHSA-2RP4-X2J7-QMCC: Stored Cross-Site Scripting via Draft Names in Craft CMS Control Panel
An authenticated stored Cross-Site Scripting (XSS) vulnerability exists in the Control Panel helper of Craft CMS before version 5.10.8. Due to lack of HTML entity encoding within the elementLabelHtml method, unescaped draft names are rendered directly into administrative interfaces.
0 views•6 min read
•about 1 hour ago•GHSA-7HXC-F267-H5Q7
4.9GHSA-7HXC-F267-H5Q7: Path Traversal via Validation-then-Normalization in Craft CMS
A path traversal vulnerability exists in the local filesystem driver of Craft CMS. Due to validation occurring before path normalization, directory containment checks can be bypassed by utilizing specific protocol schemes like 'file://' along with directory traversal sequences. This allows authenticated users with administrative privileges to access or manipulate files outside the defined storage root directory.
0 views•8 min read
•about 2 hours ago•GHSA-RVMM-V933-JGXQ
5.3GHSA-rvmm-v933-jgxq: Missing Authorization Check in Craft CMS ChartsController
An authorization bypass vulnerability in Craft CMS allows unauthenticated or low-privileged users to query and obtain sensitive time-series user registration counts and demographic metrics. This is due to a missing authorization check inside the actionGetNewUsersData endpoint of the ChartsController class.
1 views•6 min read
•about 3 hours ago•GHSA-596P-6JV8-775V
5.1GHSA-596p-6jv8-775v: Authenticated Leak of Secret Environment Variables in Craft CMS
An authenticated information disclosure vulnerability in Craft CMS allows high-privilege administrators to extract sensitive environment variables, including the CRAFT_SECURITY_KEY and database credentials, using a blind error-based template injection attack within element select condition rules.
3 views•5 min read
•about 5 hours ago•CVE-2026-71554
5.3CVE-2026-71554: HTTP Request Smuggling via Duplicate Host Headers in h2 Protocol Stack
A protocol-parsing vulnerability in the pure-Python HTTP/2 library 'h2' (versions <= 4.4.0) allows unauthenticated remote attackers to perform HTTP Request Smuggling (CWE-444). The vulnerability exists because the library does not validate the uniqueness of 'Host' headers in incoming HTTP/2 request streams. When an upstream gateway parses such requests and downgrades them to HTTP/1.1 for internal backend servers, the resulting stream contains duplicate Host headers, which leads to parsing inconsistency and potential bypass of security filters.
3 views•5 min read
•about 5 hours ago•GHSA-957R-QF9P-67XW
4.9GHSA-957R-QF9P-67XW: Arbitrary File Read via SplFileObject in Craft CMS Twig Extension
An information disclosure vulnerability in Craft CMS allows users with administrative or non-sandboxed template-authoring privileges to read arbitrary system and configuration files. The issue stems from an incomplete class instantiation blocklist in the Twig template extension, which omitted PHP's built-in SplFileObject class.
4 views•6 min read
•about 6 hours ago•CVE-2026-14793
5.3CVE-2026-14793: Authorization Bypass in Craft CMS GlobalsController actionReorderSets
An authorization bypass vulnerability in Craft CMS allows authenticated control panel users with low privileges to reorder global sets. This alters structure and writes to the project configuration database schema without administrative rights.
4 views•6 min read
•about 7 hours ago•CVE-2026-71438
2.4CVE-2026-71438: Prototype Pollution in Mermaid Configuration APIs
Prior to versions 10.9.8 and 11.16.1, Mermaid is vulnerable to prototype pollution via its deep-merge utility function assignWithDepth. This helper is invoked by public configuration-setting interfaces, specifically mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig. Because assignWithDepth recursively merges developer-provided properties into Mermaid's internal configuration state without proper sanitization, an attacker who can control or influence the configuration payload can corrupt the global Object.prototype. This vulnerability can lead to security bypasses, cross-site scripting (XSS), or execution flow modifications in applications using vulnerable Mermaid integrations.
5 views•7 min read
•about 9 hours ago•CVE-2026-67309
7.8CVE-2026-67309: Path Traversal and Authentication Bypass in Traefik RewriteTarget Middleware
A high-severity path traversal vulnerability exists in Traefik's Kubernetes Ingress NGINX provider. The flaw resides in the RewriteTarget middleware, which is auto-generated when an Ingress resource specifies the `nginx.ingress.kubernetes.io/rewrite-target` annotation. This allows remote, unauthenticated attackers to bypass route-level authentication and access restricted downstream endpoints by exploiting a parser differential.
4 views•7 min read
•about 10 hours ago•CVE-2026-65600
7.8CVE-2026-65600: Authentication Bypass via Path Traversal in Traefik ReplacePathRegex Middleware
CVE-2026-65600 is a path traversal vulnerability in the ReplacePathRegex middleware component of Traefik. An unauthenticated remote attacker can exploit the vulnerability to inject directory traversal sequences. When Traefik forwards the resulting un-normalized path, downstream backend web servers normalize the request to execute administrative or protected paths, bypassing gateway-enforced security policies.
6 views•6 min read
•about 11 hours ago•CVE-2026-54763
10.0CVE-2026-54763: Authentication Bypass and Identity Spoofing in Traefik Middlewares via Header Normalization Discrepancies
A critical authentication bypass and context spoofing vulnerability exists in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares prior to versions 2.11.51, 3.6.22, and 3.7.6. The flaw arises because Traefik's header cleanup mechanisms rely on Go's standard library header canonicalization, which does not modify or delete headers containing underscores. Consequently, unauthenticated remote attackers can inject custom underscore-variant headers (e.g., X_Auth_User) that bypass Traefik's stripping filters and reach backend application servers. When downstream backends normalize both hyphens and underscores into the same environment variables, the attacker's spoofed identity value is processed as trusted authorization data.
7 views•7 min read
•about 11 hours ago•CVE-2026-71324
7.0CVE-2026-71324: Cross-User Response Poisoning in Traefik via HTTP/2 and HTTP/3 CONNECT Handling
CVE-2026-71324 is a high-severity HTTP request smuggling vulnerability in the Traefik reverse proxy. It allows an unauthenticated remote attacker to achieve cross-user response poisoning when Traefik is configured to route HTTP/2 or HTTP/3 CONNECT requests to an HTTP/1.1 upstream backend. By sending a crafted CONNECT request that is subsequently rejected by the backend with a keep-alive non-2xx response, the attacker can leave smuggled requests within the shared connection pool, which are then served to subsequent clients.
7 views•7 min read