•about 21 hours ago•CVE-2026-93363
4.3CVE-2026-93363: Improper Access Control in Payload CMS Storage Upload Route
Payload CMS contains a missing authorization vulnerability (CWE-862) in its client-side upload instructions endpoint and the `@payloadcms/storage-vercel-blob` storage adapter. Two distinct logic defects allow authenticated users lacking collection-level `create` or `update` permissions to generate signed upload tokens and upload arbitrary files directly to external cloud storage.
7 views•9 min read
•about 22 hours ago•CVE-2026-55098
6.5CVE-2026-55098: Cross-Database Authorization Bypass via DuckDB Table-Valued I/O Functions in Basekick-Labs Arc
CVE-2026-55098 (GHSA-93cm-2v4m-c56c) is an authorization bypass and sensitive information disclosure vulnerability in Basekick-Labs Arc prior to version 26.06.2. The flaw stems from an incomplete remediation of CVE-2026-47735, which failed to restrict the full suite of DuckDB table-valued filesystem I/O functions and quoted-identifier invocations. Because Arc's query parser ignores function calls during table reference extraction, authenticated users with minimal or empty permissions can invoke functions like parquet_scan(), glob(), and read_blob() to read, enumerate, and extract telemetry data across all tenant databases residing within the shared local storage root.
7 views•10 min read
•about 23 hours ago•CVE-2026-113787
6.1CVE-2026-113787: Stored Cross-Site Scripting via Unescaped Style Attributes in odf-kit
CVE-2026-113787 is a stored Cross-Site Scripting (XSS) and HTML injection vulnerability affecting the odf-kit npm package from version 0.6.0 prior to 0.14.2. The HTML conversion engines (odtToHtml and odsToHtml) interpolate document-controlled styling and image attributes directly into inline style and src attributes without escaping double-quote characters. A remote attacker can supply a crafted .odt or .ods document to break out of HTML attribute boundaries and execute arbitrary JavaScript in the context of any web application rendering the converted HTML.
7 views•11 min read
•1 day ago•GHSA-M3QR-FVP4-78XJ
5.3GHSA-m3qr-fvp4-78xj: Authentication Bypass and Log Disclosure in Basekick Labs Arc
GHSA-m3qr-fvp4-78xj is an authentication bypass and information disclosure vulnerability in Arc, an open-source, SQL-native time-series database developed by Basekick Labs and written in Go. Due to an improper route registration sequence within the Go Fiber HTTP server initialization pipeline, the application registered the /api/v1/logs endpoint prior to mounting the global authentication middleware. Because Fiber evaluates route handlers in strict declaration order and terminates request traversal when a handler returns without invoking c.Next(), unauthenticated remote callers can query the logs endpoint and retrieve up to 10,000 buffered operational log entries even when authentication is enabled.
10 views•8 min read
•1 day ago•CVE-2026-62848
7.3CVE-2026-62848: Local Arbitrary Code Execution via Unsafe Deserialization in Metalama Named Pipe IPC
CVE-2026-62848 (GHSA-h26j-4vp7-x9w2) is a high-severity unsafe deserialization vulnerability in Metalama, a Roslyn-based meta-programming and code generation framework for C#. The flaw resides in the inter-process communication (IPC) channel used by Metalama within Microsoft Visual Studio. Across versions 2023.0 through 2026.1.18, the framework utilized either Newtonsoft.Json with TypeNameHandling.All or MessagePack with TypelessObjectResolver over local Windows named pipes without enforcing a strict type allow-list. Because the named pipes use predictable identifiers, any local process running under the same Windows user session can connect to the endpoint and transmit crafted serialized payloads, resulting in arbitrary Common Language Runtime (CLR) type instantiation and code execution within the host Visual Studio process.
10 views•9 min read
•1 day ago•GHSA-9PPR-WFW9-XVR2
5.3GHSA-9ppr-wfw9-xvr2: DNS Cache TTL Manipulation Failure in Netfoil via Go Value-Copy Range Iteration
A logic flaw in github.com/tinfoil-factory/netfoil versions 0.3.0 through 0.6.0 prevents the DNS proxy from properly decrementing Time-To-Live (TTL) values on cached DNS responses and enforcing configured maximum TTL limits. Due to an idiomatic Go programming mistake where a range loop modifies value copies of slice elements rather than the underlying slice array, netfoil continually serves DNS answers with their original static TTLs. This condition causes downstream clients and resolvers to retain stale DNS records beyond their intended expiration window and bypasses local MaxTTL administrative policies.
8 views•10 min read
•1 day ago•CVE-2026-11800
8.1CVE-2026-11800: Authentication Bypass via JWT Algorithm Confusion in Keycloak
A cryptographic signature verification flaw in Keycloak's OAuth 2.0 JWT Authorization Grant flow (RFC 7523) and federated client authentication mechanisms allows algorithm confusion between asymmetric and symmetric signing algorithms. Authenticated clients can sign forged JWT assertions using HMAC-SHA256 (HS256) with an Identity Provider's public key bytes acting as the symmetric secret. Keycloak processes the public key material as an HMAC secret key, validating the forged assertion and issuing unauthorized access tokens for federated users.
12 views•10 min read
•1 day ago•CVE-2026-62331
8.2CVE-2026-62331: Path Traversal and Stored Instruction Injection in Praktor Telegram File Uploads
CVE-2026-62331 is a high-severity path traversal vulnerability (CWE-22) affecting Praktor versions prior to 0.9.1. Praktor is a multi-agent Claude Code orchestrator that integrates Telegram message handling with isolated Docker container workspaces. Due to improper sanitization of user-controlled filenames during Telegram document uploads, a remote user can escape the designated uploads directory and overwrite arbitrary files within the persistent agent workspace volume. Because the default configuration permits messages from any Telegram user without authentication, an attacker can overwrite critical agent instruction files such as CLAUDE.md, achieving persistent prompt and instruction injection across subsequent agent executions.
8 views•9 min read
•2 days ago•GHSA-P3JP-9V83-76W9
8.1CVE-2026-111497 / GHSA-p3jp-9v83-76w9: Out-of-Bounds Heap Write in Microsoft .NET Brotli Decoder
CVE-2026-111497 (tracked as GHSA-p3jp-9v83-76w9) is an out-of-bounds heap write vulnerability in the native Google Brotli decompression library bundled within the Microsoft .NET runtime. The flaw occurs during the parsing of malformed block-switch sequences in compressed bitstreams when the fast execution path discards validation return statuses. Unauthenticated attackers delivering crafted Brotli payloads to applications configured to decompress untrusted streams can trigger memory corruption, resulting in denial of service, information disclosure, or arbitrary code execution.
11 views•11 min read
•2 days ago•CVE-2026-115878
7.8CVE-2026-115878: Arbitrary Code Execution via Nested Pickle Deserialization in Stanford NLP Stanza Lemmatizer
CVE-2026-115878 (GHSA-gh9r-c94j-cmp5) is an arbitrary code execution vulnerability in the Stanford NLP Stanza Python library affecting version 1.14.0. The flaw originates from insecure deserialization of untrusted data (CWE-502) within the lemmatizer model loading pipeline in stanza/models/lemma/trainer.py. While Stanza utilizes PyTorch's weights_only=True flag during outer checkpoint loading, it embeds a gzip-compressed pickle byte stream inside the checkpoint dictionary. Because PyTorch treats raw bytes objects as safe primitives, the nested payload bypasses the outer allowlist and is subsequently passed to an unrestricted pickle.loads() call, enabling arbitrary code execution when loading a malicious model.
10 views•9 min read
•2 days ago•CVE-2026-44265
7.4CVE-2026-44265: Code and SQL Injection via Programmatic AST Emission in @enspirit/elo
A code injection and SQL injection vulnerability exists in @enspirit/elo prior to version 1.0.1. When compiling expressions via the programmatic Abstract Syntax Tree (AST) API, the backend emitters for JavaScript, Ruby, Python, and PostgreSQL SQL fail to perform runtime type validation or lexical verification on AST node properties. Applications that construct or deserialize AST nodes from untrusted sources allow attackers to inject arbitrary code or SQL commands directly into the emitted target output.
9 views•9 min read
•2 days ago•CVE-2026-44266
9.8CVE-2026-44266: Remote Code Execution in @enspirit/elo Ruby Compiler Backend via Unescaped String Interpolation
CVE-2026-44266 (GHSA-7w38-ggh5-v542) is a code injection vulnerability in @enspirit/elo prior to version 1.0.1. The Ruby target compiler fails to escape the hash character (#) when emitting double-quoted Ruby string literals and subtype constraint failure labels. An attacker who supplies crafted Elo expressions to an application compiling and executing Ruby output achieves arbitrary code execution.
12 views•10 min read