GitHub Security Advisories

Broken object-level access control on the Template API in MicroRealEstate allows attackers to...

Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a...

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a...

MicroRealEstate allows adversaries to bypass authentication due to a lack of token state...

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows...

The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have...

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for...

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path...

The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code...

MicroRealEstate is affected by broken object-level access controls in PDF generator functionality...

Broken object-level access controls and the use of a deterministic pattern during random ID...

An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an...

Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface...

Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator...

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site...

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src...

mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method...

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative...

mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() /...

A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript...

cut: -s ignored in -z -d '' newline-delimiter mode

mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)

mkfifo: permissions of an existing file are changed after FIFO creation fails

Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write

OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export

Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

9router: Login brute-force protection bypass via spoofed X-Forwarded-For header

9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

Craft CMS: Stored XSS via Structure entry title in table view

Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing...

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14...

showdown contains a cross-site scripting vulnerability in metadata title handling that allows...

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that...

HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion...

Memory Corruption when updating prepared commands with invalid port indices based on user space...

Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed...

Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which...

Memory Corruption when processing asynchronous input parameters due to improper handling of...

Memory Corruption when handling flash commands due to outdated LED count values being used after...

Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during...

Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching...

DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability...

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input...

A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image...

Memory Corruption when invoking device input/output control operations for mapping and unmapping...

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.

The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses....

Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026...

ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker...

ArcGIS Server contains a directory traversal vulnerability. An unauthenticated attacker could...

The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login...

A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series...

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint

Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness

Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879

9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats

Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing

Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command

Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component

Coder's AI Bridge Proxy skips TLS certificate verification in default configuration

Suspended Coder users retain access to AI Bridge LLM proxy endpoints

Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints

Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

Coder's sub-agent app registration bypasses template port-sharing policy enforcement

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service

Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

Coder: User-admin role can reset owner account password

Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl

CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check

Langroid: handle_message() executes user-supplied tool JSON without sender verification

Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases

Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

Decompress: Archive extraction can create files and links outside of the target directory

printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

uucore: safe_traversal TOCTOU protection only enabled on Linux

mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)

cp: -R reads device nodes as streams, destroying device semantics

rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents, bypassing dot protection

comm: FIFO/pipe inputs are drained before comparison (data loss / hang)

id: groups= computed from real GID instead of effective GID

mkdir: -m exposes directory with umask perms before chmod (race window)

rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)

id: pretty-print uses effective GID instead of effective UID for name lookup

kill: 'kill -1' parsed as PID -1, sending SIGTERM to all processes (system crash / DoS)