•about 1 hour ago•CVE-2026-103918
6.5CVE-2026-103918: Prototype Injection and Denial of Service in oRPC @orpc/zod Smart Coercion Engine
CVE-2026-103918 is a medium-severity vulnerability within the @orpc/zod smart coercion plugin in oRPC. Prior to version 1.14.10, the package fails to sanitize untrusted input keys when performing pre-validation type coercion, allowing prototype injection on the returned request object and Denial of Service.
4 views•6 min read
•about 2 hours ago•GHSA-3CM4-CCVW-6XR6
7.5GHSA-3cm4-ccvw-6xr6: Weak Path Access Control and History/Repo-Diff Endpoint Bypass in SiYuan
A weak path access control vulnerability in SiYuan note-taking application allowed authenticated users to bypass restricted file paths by requesting historical backups and git diffs of sensitive configurations, including plain-text authentication tokens.
7 views•6 min read
•about 3 hours ago•GHSA-4WWP-F6GW-6QM5
7.7GHSA-4WWP-F6GW-6QM5: Sensitive Information Disclosure via Incomplete Path Blocklist in SiYuan
An incomplete path blocklist in the file retrieval engine of the SiYuan knowledge management platform allows authenticated users to read TLS and CA private key materials directly from the configuration directory.
6 views•6 min read
•about 11 hours ago•CVE-2026-88779
8.7CVE-2026-88779: Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix NetScaler SAML Authentication Daemon
CVE-2026-88779 is a critical vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway affecting systems configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). An unauthenticated remote attacker can exploit this vulnerability to trigger a buffer overflow in the authentication daemon, resulting in persistent denial of service and appliance crash loops.
29 views•6 min read
•2 days ago•GHSA-9Q4R-4842-93VW
7.7GHSA-9Q4R-4842-93VW: Cross-Tenant SQL Injection in Trigger.dev TSQL Query Compiler
A critical cross-tenant SQL injection vulnerability exists in the TSQL query compiler of Trigger.dev, allowing authenticated users to bypass tenant isolation boundaries and read arbitrary ClickHouse analytics logs and execution payloads belonging to other organizations.
11 views•6 min read
•2 days ago•GHSA-4672-HWV6-GQ62
5.4GHSA-4672-HWV6-GQ62: Cross-environment deployment cancellation in Trigger.dev
A logical authorization bypass vulnerability exists in Trigger.dev versions prior to 4.5.6. This flaw allows an authenticated client with a low-trust environment API key, such as development or staging, to cancel active worker deployments in a higher-trust environment like production within the same project. The vulnerability occurs because write operations on deployments were scoped solely by project identifier instead of environment identifier.
7 views•6 min read
•2 days ago•GHSA-JQMF-MX4F-HFR6
10.0GHSA-JQMF-MX4F-HFR6: Multiple Remote Code Execution and Security Flaws in Vibe-Trading AI-Agent Pipeline
An in-depth technical analysis of multiple critical security flaws identified in the Vibe-Trading ecosystem (vibe-trading-ai). These issues range from unauthenticated remote command injection via agent tool executions to arbitrary Python execution through dynamic module loading and unsafe Jinja2 template autoescaping, allowing full system compromise.
17 views•7 min read
•2 days ago•GHSA-5RMQ-CHC7-M22F
7.5GHSA-5RMQ-CHC7-M22F: Arbitrary File Read and Path Traversal in Vibe-Trading Platform
An arbitrary file read and path traversal vulnerability in the Vibe-Trading platform allows unauthenticated remote attackers to retrieve sensitive configuration files, API keys, and system secrets. The flaw stems from permissive directory checking in path validation tools and a complete lack of input sanitization in the document reader utility. Remediation was introduced in version 0.1.7 by implementing strict path allowlists, forcing user authentication, and dropping root execution privileges within the container environment.
9 views•6 min read
•2 days ago•GHSA-V2F8-6655-7GRJ
10.0GHSA-v2f8-6655-7grj: Remote Code Execution and Authentication Bypass in vibe-trading-ai
The vibe-trading-ai package prior to version 0.1.7 contains multiple critical security vulnerabilities including unauthenticated remote code execution (RCE) via session message injection, missing authentication on read endpoints, unrestricted file upload, insecure CORS policies, and sensitive key disclosure. Because the application default settings failed open, ran as root within Docker, and bound to all interfaces, remote unauthenticated attackers could compromise host environments containing sensitive trading data.
12 views•6 min read
•2 days ago•CVE-2026-18140
7.5CVE-2026-18140: Uncontrolled Recursion in aws-smithy-json Token Skipping Path
CVE-2026-18140 is a denial-of-service vulnerability in the Amazon aws-smithy-json Rust crate. Under-validation of recursion depth within the unknown-key skipping path allows a remote, unauthenticated attacker to cause stack exhaustion and process aborts by sending deeply nested JSON arrays.
10 views•6 min read
•2 days ago•GHSA-FJ2X-MQQP-3V2W
7.5GHSA-FJ2X-MQQP-3V2W: Sensitive Information Disclosure in Trigger.dev CLI Build Logs
A sensitive information disclosure vulnerability exists in the Trigger.dev Command Line Interface (CLI) framework. When executing build processes inside CLI v3 packages, the framework's debug deployment logs print unredacted, resolved environment variables and secrets to standard output or log streams. This exposure occurs when the CLI is operated with a high logging verbosity level, enabling any individual or automated system with read access to build logs, CI/CD output consoles, or local development streams to capture plaintext sensitive parameters, such as database credentials, API keys, and private external integration tokens.
9 views•6 min read
•2 days ago•CVE-2026-104855
2.0CVE-2026-104855: Sandbox Escape via Reentrant State Desynchronization in Wasmtime Bulk Memory Operations
CVE-2026-104855 is a critical vulnerability involving a race condition and reentrant state desynchronization within Wasmtime, a standalone WebAssembly runtime. Due to incremental mid-operation preemption points in compiler-generated loops for bulk memory and table operations, a host-defined epoch or fuel deadline callback could mutate the WebAssembly Store. Upon resuming, the virtual machine utilized stale cached pointers, resulting in use-after-free, out-of-bounds writes, and sandbox escape.
8 views•7 min read