•about 1 hour ago•CVE-2026-59992
5.4CVE-2026-59992: Broken Access Control and Path Traversal in Tina CMS Production Media Adapters
CVE-2026-59992 is a critical broken access control vulnerability in the first-party production media adapters of Tina CMS, including next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, and next-tinacms-cloudinary. The issue allows authenticated editors to escape the configured mediaRoot directory containment, facilitating unauthorized file uploads, modifications, and deletions across the entire storage bucket or container.
1 views•6 min read
•about 2 hours ago•CVE-2026-63123
6.5CVE-2026-63123: Cross-Site Request Forgery leading to Cross-Origin Arbitrary File Write in @tinacms/cli
A Cross-Site Request Forgery (CSRF) vulnerability in the local development server of @tinacms/cli allowed malicious cross-origin pages to send state-changing HTTP requests. This issue permitted attackers to write arbitrary files into a developer's project directory or manipulate search and GraphQL indices without authorization.
5 views•4 min read
•about 3 hours ago•CVE-2026-63188
8.7CVE-2026-63188: Unauthenticated Directory Traversal in @logto/tunnel
A high-severity path traversal vulnerability exists in the @logto/tunnel npm package (part of the Logto repository) prior to version 0.3.9. Remote unauthenticated attackers can exploit this vulnerability to read arbitrary local files by sending crafted HTTP requests with directory traversal sequences when the static file proxy is active.
4 views•7 min read
•about 10 hours ago•CVE-2026-54347
8.7CVE-2026-54347: Stored Cross-Site Scripting in Froxlor DNS TXT Record Configuration
A critical stored Cross-Site Scripting (XSS) vulnerability was identified in Froxlor server administration software panel before version 2.3.8. Authenticated customers with DNS editor privileges can inject malicious JavaScript into DNS TXT records. Because the application processes these values via a raw formatting callback without context-aware HTML entity encoding, the payload executes in the security context of administrative users who view the affected domain's DNS zones.
4 views•6 min read
•about 11 hours ago•CVE-2026-54348
7.2CVE-2026-54348: Second-Order SQL Injection in Froxlor API Layer
An authenticated administrator with privileges to manage admin accounts (such as change_serversettings) can execute arbitrary SQL commands via a second-order SQL injection vulnerability. The flaw resides in Froxlor's administrative API endpoints, specifically during the handling of IP address mapping parameters which are stored as serialized arrays and later interpolated without sanitization into active database queries. This vulnerability allows high-privileged administrative attackers to compromise the database. By injecting a payload into administrative profile metadata, an attacker can extract sensitive credentials, manipulate backend settings, or potentially disrupt database integrity. The vulnerability affects all versions of Froxlor prior to 2.3.8.
5 views•6 min read
•about 12 hours ago•CVE-2026-54543
5.4CVE-2026-54543: DNS Resource Record (RR) Injection in Froxlor DomainZones API
CVE-2026-54543 is a DNS Resource Record (RR) Injection vulnerability in Froxlor, an open-source server administration control panel. Prior to version 2.3.8, the DomainZones.add API command failed to perform strict sanitization and validation on the user-controlled record (label) and type parameters before serializing them into BIND-compatible zone files. An authenticated customer with DNS zone management permissions can inject control characters, breaking out of the original record context to define unauthorized resource records within managed zones.
4 views•7 min read
•about 12 hours ago•CVE-2026-42533
9.2CVE-2026-42533: NGINX Map Directive and Regex Matching Pre-Auth Heap Buffer Overflow & Info Leak
CVE-2026-42533 is a critical security vulnerability discovered in NGINX Open Source, NGINX Plus, NGINX Ingress Controller, and related products, referred to as the 'Two-Pass Capture-Clobbering' bug. The flaw is situated within NGINX's internal evaluation engine when handling complex variables, exposing a heap-based buffer overflow and information leak when a configuration chains regular expression-based map directives with numbered capture groups. An unauthenticated remote attacker can exploit this weakness by transmitting crafted HTTP requests to trigger remote code execution or defeat ASLR.
7 views•7 min read
•about 13 hours ago•CVE-2026-55593
6.5CVE-2026-55593: Persistent Administrative Hijacking via Cross-Site Request Forgery in Froxlor Ajax Router
Froxlor prior to version 2.3.8 contains a high-severity architectural flaw where the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php. Unauthenticated remote attackers can leverage Cross-Site Request Forgery (CSRF) to induce authenticated administrators to submit forged requests that modify API key whitelists and expiration dates, potentially yielding persistent, out-of-band administrative control.
6 views•8 min read
•about 14 hours ago•CVE-2026-62988
9.0CVE-2026-62988: Multi-Factor Authentication and Credential Bypass in Froxlor API
An insecure data retrieval flaw in the Froxlor server administration panel API allows authenticated remote attackers to retrieve unredacted bcrypt password hashes and Base32-encoded Time-Based One-Time Password (TOTP) seeds. Affected endpoints include several 'get' and 'listing' handlers for customers, administrators, and FTP accounts. Utilizing these leaked parameters, attackers can crack the password hashes offline and concurrently generate valid second-factor authentication codes to completely bypass access controls.
8 views•6 min read
•about 15 hours ago•CVE-2026-70666
7.4CVE-2026-70666: Server-Side Request Forgery in Netflix Lemur ACME Authority Management
CVE-2026-70666 is a critical Server-Side Request Forgery (SSRF) vulnerability in Netflix Lemur's ACME certificate management integration. Prior to version 1.9.3, the system allowed authority-role users to bypass initial ACME URL allowlist validations when updating an existing authority. Additionally, the underlying ACME network client blindly parsed and connected to dynamic endpoint URLs supplied in JSON responses from the configured ACME directory, allowing attackers to route arbitrary JWS-signed requests to internal services or cloud metadata endpoints.
5 views•5 min read
•about 16 hours ago•CVE-2026-70667
6.3CVE-2026-70667: Server-Side Request Forgery Bypass in Netflix Lemur Certificate Verification
A security vulnerability in Netflix Lemur, a TLS certificate management framework, allows authenticated operators to bypass Server-Side Request Forgery (SSRF) mitigations. The issue exists within the certificate revocation verification workflow, specifically inside the CRL and OCSP retrieval logic. By exploiting HTTP redirects or DNS rebinding (Time-of-Check Time-of-Use) mechanisms, an attacker can coerce the server into issuing arbitrary network requests to internal services, such as the cloud instance metadata service (IMDS) or loopback addresses. This bypass neutralizes previous network-boundary validation logic and allows blind read/write SSRF targeting internal infrastructure resources.
6 views•6 min read
•about 17 hours ago•CVE-2026-71303
7.7CVE-2026-71303: Server-Side Request Forgery Bypass in Netflix Lemur Authority Updates
Netflix Lemur, an open-source TLS certificate management framework, is affected by a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability arises from an incomplete patch for a previous security flaw, CVE-2026-55166. While Lemur version 1.9.2 validated the ACME directory URL against an allowlist during authority creation, it failed to perform the same checks when updating existing authorities. An authenticated user possessing an authority role can exploit this omission to replace the directory URL with internal or cloud metadata endpoints. During subsequent certificate issuance, the Lemur backend executes unauthorized requests, potentially leaking sensitive metadata or credentials.
6 views•6 min read