Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
18506 vulnerabilities
CVE-2026-63178 (GCVE-0-2026-63178)
Vulnerability from cvelistv5 – Published: 2026-08-17 21:30 – Updated: 2026-08-17 21:30
VLAI
EPSS
VEX
Title
Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure
Summary
Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints in ee/onyx/server/user_group/api.py call update_user_group and add_users_to_user_group in ee/onyx/db/user_group.py without enforcing _validate_curator_can_modify_group, allowing a curator to add accounts to arbitrary groups and obtain document access through get_acl_for_user and the OpenSearch access_control_list filter. This issue is fixed in version 4.3.0.
Severity
6.5 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/onyx-dot-app/onyx/security/adv… | x_refsource_CONFIRM |
| https://github.com/onyx-dot-app/onyx/pull/12525 | x_refsource_MISC |
| https://github.com/onyx-dot-app/onyx/pull/12549 | x_refsource_MISC |
| https://github.com/onyx-dot-app/onyx/commit/46e19… | x_refsource_MISC |
| https://github.com/onyx-dot-app/onyx/commit/b9e1c… | x_refsource_MISC |
| https://github.com/onyx-dot-app/onyx/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| onyx-dot-app | onyx |
Affected:
< 4.3.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "onyx",
"vendor": "onyx-dot-app",
"versions": [
{
"status": "affected",
"version": "\u003c 4.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition\u0027s PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints in ee/onyx/server/user_group/api.py call update_user_group and add_users_to_user_group in ee/onyx/db/user_group.py without enforcing _validate_curator_can_modify_group, allowing a curator to add accounts to arbitrary groups and obtain document access through get_acl_for_user and the OpenSearch access_control_list filter. This issue is fixed in version 4.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T21:30:40.463Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-7f48-vgpj-h95m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-7f48-vgpj-h95m"
},
{
"name": "https://github.com/onyx-dot-app/onyx/pull/12525",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onyx-dot-app/onyx/pull/12525"
},
{
"name": "https://github.com/onyx-dot-app/onyx/pull/12549",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onyx-dot-app/onyx/pull/12549"
},
{
"name": "https://github.com/onyx-dot-app/onyx/commit/46e19cc2750fed659488cb12a1f171016ba5a099",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onyx-dot-app/onyx/commit/46e19cc2750fed659488cb12a1f171016ba5a099"
},
{
"name": "https://github.com/onyx-dot-app/onyx/commit/b9e1c6894be3c237283f4b5fd4eb0af935b40664",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onyx-dot-app/onyx/commit/b9e1c6894be3c237283f4b5fd4eb0af935b40664"
},
{
"name": "https://github.com/onyx-dot-app/onyx/releases/tag/v4.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onyx-dot-app/onyx/releases/tag/v4.3.0"
}
],
"source": {
"advisory": "GHSA-7f48-vgpj-h95m",
"discovery": "UNKNOWN"
},
"title": "Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63178",
"datePublished": "2026-08-17T21:30:40.463Z",
"dateReserved": "2026-07-15T22:13:00.720Z",
"dateUpdated": "2026-08-17T21:30:40.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71424 (GCVE-0-2026-71424)
Vulnerability from cvelistv5 – Published: 2026-08-17 21:28 – Updated: 2026-08-17 21:28
VLAI
EPSS
VEX
Title
Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers
Summary
Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_server_to_api_mcp_server returns that row through auth_template.headers to any BASIC_ACCESS user. This issue is fixed in versions 3.1.10, 3.2.14, and 4.0.0.
Severity
9.6 (Critical)
CWE
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/onyx-dot-app/onyx/security/adv… | x_refsource_CONFIRM |
| https://github.com/onyx-dot-app/onyx/pull/11238 | x_refsource_MISC |
| https://github.com/onyx-dot-app/onyx/pull/11242 | x_refsource_MISC |
| https://github.com/onyx-dot-app/onyx/pull/11243 | x_refsource_MISC |
| https://github.com/onyx-dot-app/onyx/commit/3f3d7… | x_refsource_MISC |
| https://github.com/onyx-dot-app/onyx/commit/4001c… | x_refsource_MISC |
| https://github.com/onyx-dot-app/onyx/commit/b1039… | x_refsource_MISC |
| https://github.com/onyx-dot-app/onyx/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| onyx-dot-app | onyx |
Affected:
< 3.1.10
Affected: >= 3.2.0, < 3.2.14 Affected: >= 3.3.0-beta.0, < 4.0.0 |
{
"containers": {
"cna": {
"affected": [
{
"product": "onyx",
"vendor": "onyx-dot-app",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.10"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.14"
},
{
"status": "affected",
"version": "\u003e= 3.3.0-beta.0, \u003c 4.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx\u0027s GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user\u0027s OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_server_to_api_mcp_server returns that row through auth_template.headers to any BASIC_ACCESS user. This issue is fixed in versions 3.1.10, 3.2.14, and 4.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T21:28:32.814Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-q62f-rv3h-f822",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-q62f-rv3h-f822"
},
{
"name": "https://github.com/onyx-dot-app/onyx/pull/11238",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onyx-dot-app/onyx/pull/11238"
},
{
"name": "https://github.com/onyx-dot-app/onyx/pull/11242",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onyx-dot-app/onyx/pull/11242"
},
{
"name": "https://github.com/onyx-dot-app/onyx/pull/11243",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onyx-dot-app/onyx/pull/11243"
},
{
"name": "https://github.com/onyx-dot-app/onyx/commit/3f3d79d1a7722fdc84a1c61c8aa830d890017e9e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onyx-dot-app/onyx/commit/3f3d79d1a7722fdc84a1c61c8aa830d890017e9e"
},
{
"name": "https://github.com/onyx-dot-app/onyx/commit/4001cedd0a8968723bfe95dd188914ed56777910",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onyx-dot-app/onyx/commit/4001cedd0a8968723bfe95dd188914ed56777910"
},
{
"name": "https://github.com/onyx-dot-app/onyx/commit/b103937888fd5008067c2bb6eb6e5424576394f2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onyx-dot-app/onyx/commit/b103937888fd5008067c2bb6eb6e5424576394f2"
},
{
"name": "https://github.com/onyx-dot-app/onyx/releases/tag/v4.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onyx-dot-app/onyx/releases/tag/v4.0.0"
}
],
"source": {
"advisory": "GHSA-q62f-rv3h-f822",
"discovery": "UNKNOWN"
},
"title": "Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71424",
"datePublished": "2026-08-17T21:28:32.814Z",
"dateReserved": "2026-08-06T16:28:51.182Z",
"dateUpdated": "2026-08-17T21:28:32.814Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45791 (GCVE-0-2026-45791)
Vulnerability from cvelistv5 – Published: 2026-08-17 21:25 – Updated: 2026-08-17 21:25
VLAI
EPSS
VEX
Title
Dokploy: Password Change Does Not Revoke Active Sessions
Summary
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.
Severity
5.9 (Medium)
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Dokploy/dokploy/security/advis… | x_refsource_CONFIRM |
| https://github.com/Dokploy/dokploy/pull/4475 | x_refsource_MISC |
| https://github.com/Dokploy/dokploy/commit/a07106d… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "dokploy",
"vendor": "Dokploy",
"versions": [
{
"status": "affected",
"version": "\u003c 0.29.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy\u0027s user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T21:25:53.386Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-rr9m-w87g-46f3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-rr9m-w87g-46f3"
},
{
"name": "https://github.com/Dokploy/dokploy/pull/4475",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Dokploy/dokploy/pull/4475"
},
{
"name": "https://github.com/Dokploy/dokploy/commit/a07106d649991ea09892220873ea3243766c3e08",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Dokploy/dokploy/commit/a07106d649991ea09892220873ea3243766c3e08"
}
],
"source": {
"advisory": "GHSA-rr9m-w87g-46f3",
"discovery": "UNKNOWN"
},
"title": "Dokploy: Password Change Does Not Revoke Active Sessions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45791",
"datePublished": "2026-08-17T21:25:53.386Z",
"dateReserved": "2026-05-13T08:19:32.602Z",
"dateUpdated": "2026-08-17T21:25:53.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45790 (GCVE-0-2026-45790)
Vulnerability from cvelistv5 – Published: 2026-08-17 21:24 – Updated: 2026-08-17 21:24
VLAI
EPSS
VEX
Title
Dokploy: Invitation Role Escalation Allows Organization Takeover
Summary
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.
Severity
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Dokploy/dokploy/security/advis… | x_refsource_CONFIRM |
| https://github.com/Dokploy/dokploy/pull/4475 | x_refsource_MISC |
| https://github.com/Dokploy/dokploy/commit/a07106d… | x_refsource_MISC |
| https://github.com/Dokploy/dokploy/releases/tag/v0.29.6 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "dokploy",
"vendor": "Dokploy",
"versions": [
{
"status": "affected",
"version": "\u003c 0.29.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy\u0027s organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T21:24:22.499Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-fm9p-wmpw-gxjh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-fm9p-wmpw-gxjh"
},
{
"name": "https://github.com/Dokploy/dokploy/pull/4475",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Dokploy/dokploy/pull/4475"
},
{
"name": "https://github.com/Dokploy/dokploy/commit/a07106d649991ea09892220873ea3243766c3e08",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Dokploy/dokploy/commit/a07106d649991ea09892220873ea3243766c3e08"
},
{
"name": "https://github.com/Dokploy/dokploy/releases/tag/v0.29.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Dokploy/dokploy/releases/tag/v0.29.6"
}
],
"source": {
"advisory": "GHSA-fm9p-wmpw-gxjh",
"discovery": "UNKNOWN"
},
"title": "Dokploy: Invitation Role Escalation Allows Organization Takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45790",
"datePublished": "2026-08-17T21:24:22.499Z",
"dateReserved": "2026-05-13T08:19:32.602Z",
"dateUpdated": "2026-08-17T21:24:22.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69146 (GCVE-0-2026-69146)
Vulnerability from cvelistv5 – Published: 2026-08-17 21:22 – Updated: 2026-08-17 21:22
VLAI
EPSS
VEX
Title
MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth
Summary
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.
Severity
6.5 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mlflow/mlflow/security/advisor… | x_refsource_CONFIRM |
| https://github.com/mlflow/mlflow/pull/24291 | x_refsource_MISC |
| https://github.com/mlflow/mlflow/commit/5c34aec56… | x_refsource_MISC |
| https://github.com/mlflow/mlflow/releases/tag/v3.15.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "mlflow",
"vendor": "mlflow",
"versions": [
{
"status": "affected",
"version": "\u003c 3.15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user\u0027s run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T21:22:42.240Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5"
},
{
"name": "https://github.com/mlflow/mlflow/pull/24291",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mlflow/mlflow/pull/24291"
},
{
"name": "https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693"
},
{
"name": "https://github.com/mlflow/mlflow/releases/tag/v3.15.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mlflow/mlflow/releases/tag/v3.15.0"
}
],
"source": {
"advisory": "GHSA-3p64-6gvh-82v5",
"discovery": "UNKNOWN"
},
"title": "MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69146",
"datePublished": "2026-08-17T21:22:42.240Z",
"dateReserved": "2026-08-03T15:20:30.218Z",
"dateUpdated": "2026-08-17T21:22:42.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69148 (GCVE-0-2026-69148)
Vulnerability from cvelistv5 – Published: 2026-08-17 21:21 – Updated: 2026-08-17 21:21
VLAI
EPSS
VEX
Title
MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
Summary
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id after _validate_source_run() or _validate_source_model() in mlflow/server/handlers.py verifies only path containment, allowing authenticated users to create a model version that references another user's artifact directory and read files through GET /model-versions/get-artifact without the required READ permission. This issue is fixed in version 3.15.0.
Severity
7.1 (High)
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mlflow/mlflow/security/advisor… | x_refsource_CONFIRM |
| https://github.com/mlflow/mlflow/pull/24293 | x_refsource_MISC |
| https://github.com/mlflow/mlflow/commit/4bb747477… | x_refsource_MISC |
| https://github.com/mlflow/mlflow/releases/tag/v3.15.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "mlflow",
"vendor": "mlflow",
"versions": [
{
"status": "affected",
"version": "\u003c 3.15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id after _validate_source_run() or _validate_source_model() in mlflow/server/handlers.py verifies only path containment, allowing authenticated users to create a model version that references another user\u0027s artifact directory and read files through GET /model-versions/get-artifact without the required READ permission. This issue is fixed in version 3.15.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T21:21:10.279Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mlflow/mlflow/security/advisories/GHSA-gqch-g4w5-7qcw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mlflow/mlflow/security/advisories/GHSA-gqch-g4w5-7qcw"
},
{
"name": "https://github.com/mlflow/mlflow/pull/24293",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mlflow/mlflow/pull/24293"
},
{
"name": "https://github.com/mlflow/mlflow/commit/4bb7474771c3be808cd9e129defef9305f2869be",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mlflow/mlflow/commit/4bb7474771c3be808cd9e129defef9305f2869be"
},
{
"name": "https://github.com/mlflow/mlflow/releases/tag/v3.15.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mlflow/mlflow/releases/tag/v3.15.0"
}
],
"source": {
"advisory": "GHSA-gqch-g4w5-7qcw",
"discovery": "UNKNOWN"
},
"title": "MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69148",
"datePublished": "2026-08-17T21:21:10.279Z",
"dateReserved": "2026-08-03T15:47:09.654Z",
"dateUpdated": "2026-08-17T21:21:10.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64849 (GCVE-0-2026-64849)
Vulnerability from cvelistv5 – Published: 2026-08-17 21:16 – Updated: 2026-08-17 21:16
VLAI
EPSS
VEX
Title
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
Summary
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
Severity
9.3 (Critical)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/mlflow/mlflow/security/advisor… | x_refsource_CONFIRM |
| https://github.com/mlflow/mlflow/issues/24179 | x_refsource_MISC |
| https://github.com/mlflow/mlflow/pull/24258 | x_refsource_MISC |
| https://github.com/mlflow/mlflow/commit/ba9495224… | x_refsource_MISC |
| https://github.com/mlflow/mlflow/releases/tag/v3.15.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "mlflow",
"vendor": "mlflow",
"versions": [
{
"status": "affected",
"version": "\u003c 3.15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T21:16:10.612Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j"
},
{
"name": "https://github.com/mlflow/mlflow/issues/24179",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mlflow/mlflow/issues/24179"
},
{
"name": "https://github.com/mlflow/mlflow/pull/24258",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mlflow/mlflow/pull/24258"
},
{
"name": "https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939"
},
{
"name": "https://github.com/mlflow/mlflow/releases/tag/v3.15.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mlflow/mlflow/releases/tag/v3.15.0"
}
],
"source": {
"advisory": "GHSA-7gwp-5pfp-969j",
"discovery": "UNKNOWN"
},
"title": "MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-64849",
"datePublished": "2026-08-17T21:16:10.612Z",
"dateReserved": "2026-07-20T18:31:39.290Z",
"dateUpdated": "2026-08-17T21:16:10.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56677 (GCVE-0-2026-56677)
Vulnerability from cvelistv5 – Published: 2026-08-17 21:14 – Updated: 2026-08-17 21:14
VLAI
EPSS
VEX
Title
9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
Summary
9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.
Severity
8.6 (High)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/decolua/9router/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"cna": {
"affected": [
{
"product": "9router",
"vendor": "decolua",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.5.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "9Router is an AI router \u0026 token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T21:14:06.082Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx"
}
],
"source": {
"advisory": "GHSA-8g4w-4ffg-8vgx",
"discovery": "UNKNOWN"
},
"title": "9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-56677",
"datePublished": "2026-08-17T21:14:06.082Z",
"dateReserved": "2026-06-22T16:39:01.044Z",
"dateUpdated": "2026-08-17T21:14:06.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44846 (GCVE-0-2026-44846)
Vulnerability from cvelistv5 – Published: 2026-08-17 21:04 – Updated: 2026-08-17 21:04
VLAI
EPSS
VEX
Title
JumpServer: Privilege Overwrite via Organization Invite Logic Flaw
Summary
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite_user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to execute user.org_roles.set(org_roles) and replace the member's existing organization roles, which can escalate privileges or downgrade administrators. This issue is fixed in version 4.10.17.
Severity
6.2 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/jumpserver/jumpserver/security… | x_refsource_CONFIRM |
| https://github.com/jumpserver/jumpserver/pull/16662 | x_refsource_MISC |
| https://github.com/jumpserver/jumpserver/commit/1… | x_refsource_MISC |
| https://github.com/jumpserver/jumpserver/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jumpserver | jumpserver |
Affected:
< 4.10.17
|
{
"containers": {
"cna": {
"affected": [
{
"product": "jumpserver",
"vendor": "jumpserver",
"versions": [
{
"status": "affected",
"version": "\u003c 4.10.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite_user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to execute user.org_roles.set(org_roles) and replace the member\u0027s existing organization roles, which can escalate privileges or downgrade administrators. This issue is fixed in version 4.10.17."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T21:04:18.891Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-j836-99w5-523r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-j836-99w5-523r"
},
{
"name": "https://github.com/jumpserver/jumpserver/pull/16662",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jumpserver/jumpserver/pull/16662"
},
{
"name": "https://github.com/jumpserver/jumpserver/commit/1803be11a410eb99cd171d47053b697a119c4a50",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jumpserver/jumpserver/commit/1803be11a410eb99cd171d47053b697a119c4a50"
},
{
"name": "https://github.com/jumpserver/jumpserver/releases/tag/v4.10.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jumpserver/jumpserver/releases/tag/v4.10.17"
}
],
"source": {
"advisory": "GHSA-j836-99w5-523r",
"discovery": "UNKNOWN"
},
"title": "JumpServer: Privilege Overwrite via Organization Invite Logic Flaw"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44846",
"datePublished": "2026-08-17T21:04:18.891Z",
"dateReserved": "2026-05-07T21:21:48.353Z",
"dateUpdated": "2026-08-17T21:04:18.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44845 (GCVE-0-2026-44845)
Vulnerability from cvelistv5 – Published: 2026-08-17 21:03 – Updated: 2026-08-17 21:03
VLAI
EPSS
VEX
Title
JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment
Summary
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing Ansible to evaluate ansible_host inventory data or playbook variables during Applet Host deployment and execute arbitrary commands on the JumpServer control node. This issue is fixed in version 4.10.17.
Severity
6.7 (Medium)
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/jumpserver/jumpserver/security… | x_refsource_CONFIRM |
| https://github.com/jumpserver/jumpserver/pull/16749 | x_refsource_MISC |
| https://github.com/jumpserver/jumpserver/pull/16886 | x_refsource_MISC |
| https://github.com/jumpserver/jumpserver/commit/c… | x_refsource_MISC |
| https://github.com/jumpserver/jumpserver/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jumpserver | jumpserver |
Affected:
< 4.10.17
|
{
"containers": {
"cna": {
"affected": [
{
"product": "jumpserver",
"vendor": "jumpserver",
"versions": [
{
"status": "affected",
"version": "\u003c 4.10.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing Ansible to evaluate ansible_host inventory data or playbook variables during Applet Host deployment and execute arbitrary commands on the JumpServer control node. This issue is fixed in version 4.10.17."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T21:03:08.891Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-22h6-pcgh-9v7q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-22h6-pcgh-9v7q"
},
{
"name": "https://github.com/jumpserver/jumpserver/pull/16749",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jumpserver/jumpserver/pull/16749"
},
{
"name": "https://github.com/jumpserver/jumpserver/pull/16886",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jumpserver/jumpserver/pull/16886"
},
{
"name": "https://github.com/jumpserver/jumpserver/commit/cc57ba0de5f6015746fae11cfc62402b11618e59",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jumpserver/jumpserver/commit/cc57ba0de5f6015746fae11cfc62402b11618e59"
},
{
"name": "https://github.com/jumpserver/jumpserver/releases/tag/v4.10.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jumpserver/jumpserver/releases/tag/v4.10.17"
}
],
"source": {
"advisory": "GHSA-22h6-pcgh-9v7q",
"discovery": "UNKNOWN"
},
"title": "JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44845",
"datePublished": "2026-08-17T21:03:08.891Z",
"dateReserved": "2026-05-07T21:21:48.353Z",
"dateUpdated": "2026-08-17T21:03:08.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54336 (GCVE-0-2026-54336)
Vulnerability from cvelistv5 – Published: 2026-08-17 21:01 – Updated: 2026-08-17 21:01
VLAI
EPSS
VEX
Title
JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset
Summary
JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath() in pkg/srvconn/sftp_asset.go to resolve paths outside the intended SFTP root and permit read, list, write, rename, or delete operations under the configured backend account on that asset. This issue is fixed in version 4.10.17.
Severity
5.4 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/jumpserver/jumpserver/security… | x_refsource_CONFIRM |
| https://github.com/jumpserver/koko/commit/02fabeb… | x_refsource_MISC |
| https://github.com/jumpserver/koko/releases/tag/v… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jumpserver | jumpserver |
Affected:
>= 4.8.0, < 4.10.17
|
{
"containers": {
"cna": {
"affected": [
{
"product": "jumpserver",
"vendor": "jumpserver",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.8.0, \u003c 4.10.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath() in pkg/srvconn/sftp_asset.go to resolve paths outside the intended SFTP root and permit read, list, write, rename, or delete operations under the configured backend account on that asset. This issue is fixed in version 4.10.17."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T21:01:48.667Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-x6rg-36j6-76vr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-x6rg-36j6-76vr"
},
{
"name": "https://github.com/jumpserver/koko/commit/02fabebe27dacce89114fba122c667a946fd12ea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jumpserver/koko/commit/02fabebe27dacce89114fba122c667a946fd12ea"
},
{
"name": "https://github.com/jumpserver/koko/releases/tag/v4.10.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jumpserver/koko/releases/tag/v4.10.17"
}
],
"source": {
"advisory": "GHSA-x6rg-36j6-76vr",
"discovery": "UNKNOWN"
},
"title": "JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54336",
"datePublished": "2026-08-17T21:01:48.667Z",
"dateReserved": "2026-06-12T19:23:22.316Z",
"dateUpdated": "2026-08-17T21:01:48.667Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65976 (GCVE-0-2026-65976)
Vulnerability from cvelistv5 – Published: 2026-08-17 21:00 – Updated: 2026-08-17 21:00
VLAI
EPSS
VEX
Title
Deskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limit
Summary
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.
Severity
6.5 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/deskflow/deskflow/security/adv… | x_refsource_CONFIRM |
| https://github.com/deskflow/deskflow/commit/8a535… | x_refsource_MISC |
| https://github.com/deskflow/deskflow/commit/bcd3a… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "deskflow",
"vendor": "deskflow",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.17.0, \u003c 1.26.0.300"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T21:00:41.175Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/deskflow/deskflow/security/advisories/GHSA-jf7g-qghg-p54x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/deskflow/deskflow/security/advisories/GHSA-jf7g-qghg-p54x"
},
{
"name": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef"
},
{
"name": "https://github.com/deskflow/deskflow/commit/bcd3a658fc3b2ad735146fdc9efefa9462d195b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/deskflow/deskflow/commit/bcd3a658fc3b2ad735146fdc9efefa9462d195b7"
}
],
"source": {
"advisory": "GHSA-jf7g-qghg-p54x",
"discovery": "UNKNOWN"
},
"title": "Deskflow: Clipboard receiver can accumulate data beyond Deskflow\u0027s configured clipboard size limit"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65976",
"datePublished": "2026-08-17T21:00:41.175Z",
"dateReserved": "2026-07-23T18:15:14.581Z",
"dateUpdated": "2026-08-17T21:00:41.175Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65832 (GCVE-0-2026-65832)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:59 – Updated: 2026-08-17 20:59
VLAI
EPSS
VEX
Title
Deskflow - Unauthenticated server-controlled out-of-bounds read in ServerProxy::setOptions / translateKey modifier-table indexing
Summary
Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.
Severity
8.2 (High)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/deskflow/deskflow/security/adv… | x_refsource_CONFIRM |
| https://github.com/deskflow/deskflow/commit/205a3… | x_refsource_MISC |
| https://github.com/deskflow/deskflow/commit/8266f… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "deskflow",
"vendor": "deskflow",
"versions": [
{
"status": "affected",
"version": "\u003c 1.26.0.299"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:59:08.714Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/deskflow/deskflow/security/advisories/GHSA-8rcq-7w87-h64j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/deskflow/deskflow/security/advisories/GHSA-8rcq-7w87-h64j"
},
{
"name": "https://github.com/deskflow/deskflow/commit/205a3c803e5298d56683660736ec1a41b671b56e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/deskflow/deskflow/commit/205a3c803e5298d56683660736ec1a41b671b56e"
},
{
"name": "https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f"
}
],
"source": {
"advisory": "GHSA-8rcq-7w87-h64j",
"discovery": "UNKNOWN"
},
"title": "Deskflow - Unauthenticated server-controlled out-of-bounds read in ServerProxy::setOptions / translateKey modifier-table indexing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65832",
"datePublished": "2026-08-17T20:59:08.714Z",
"dateReserved": "2026-07-22T23:16:47.753Z",
"dateUpdated": "2026-08-17T20:59:08.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63409 (GCVE-0-2026-63409)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:57 – Updated: 2026-08-17 20:57
VLAI
EPSS
VEX
Title
Deskflow: Odd-length DSOP options vector causes out-of-bounds read in Deskflow client
Summary
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp, causing the missing value after the final option key to be read beyond the vector during the PacketStreamFilter::filterEvent to ServerProxy::handleData() to ServerProxy::parseHandshakeMessage() call chain and crash the connected client. This issue is fixed in continuous build 1.26.0.296.
Severity
8.2 (High)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/deskflow/deskflow/security/adv… | x_refsource_CONFIRM |
| https://github.com/deskflow/deskflow/commit/8266f… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "deskflow",
"vendor": "deskflow",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.17.0, \u003c 1.26.0.296"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp, causing the missing value after the final option key to be read beyond the vector during the PacketStreamFilter::filterEvent to ServerProxy::handleData() to ServerProxy::parseHandshakeMessage() call chain and crash the connected client. This issue is fixed in continuous build 1.26.0.296."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:57:19.326Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/deskflow/deskflow/security/advisories/GHSA-gmvh-3c73-m5gg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/deskflow/deskflow/security/advisories/GHSA-gmvh-3c73-m5gg"
},
{
"name": "https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f"
}
],
"source": {
"advisory": "GHSA-gmvh-3c73-m5gg",
"discovery": "UNKNOWN"
},
"title": "Deskflow: Odd-length DSOP options vector causes out-of-bounds read in Deskflow client"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63409",
"datePublished": "2026-08-17T20:57:19.326Z",
"dateReserved": "2026-07-16T19:20:28.987Z",
"dateUpdated": "2026-08-17T20:57:19.326Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47683 (GCVE-0-2026-47683)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:55 – Updated: 2026-08-17 20:55
VLAI
EPSS
VEX
Title
vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
Summary
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap and can exhaust the host process. This issue is fixed in version 3.11.6.
Severity
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/patriksimek/vm2/security/advis… | x_refsource_CONFIRM |
| https://github.com/patriksimek/vm2/commit/3ffb315… | x_refsource_MISC |
| https://github.com/patriksimek/vm2/releases/tag/3.11.6 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| patriksimek | vm2 |
Affected:
< 3.11.6
|
{
"containers": {
"cna": {
"affected": [
{
"product": "vm2",
"vendor": "patriksimek",
"versions": [
{
"status": "affected",
"version": "\u003c 3.11.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap and can exhaust the host process. This issue is fixed in version 3.11.6."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:55:32.019Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9"
},
{
"name": "https://github.com/patriksimek/vm2/commit/3ffb315512e634cf85c447375e85d6c83d00a4bd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/patriksimek/vm2/commit/3ffb315512e634cf85c447375e85d6c83d00a4bd"
},
{
"name": "https://github.com/patriksimek/vm2/releases/tag/3.11.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/patriksimek/vm2/releases/tag/3.11.6"
}
],
"source": {
"advisory": "GHSA-gmc2-2x9w-cgh9",
"discovery": "UNKNOWN"
},
"title": "vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47683",
"datePublished": "2026-08-17T20:55:32.019Z",
"dateReserved": "2026-05-19T21:18:20.402Z",
"dateUpdated": "2026-08-17T20:55:32.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47686 (GCVE-0-2026-47686)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:54 – Updated: 2026-08-17 20:54
VLAI
EPSS
VEX
Title
vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE
Summary
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-exposed host function that throws an error with that object as its cause and then execute arbitrary host commands. This issue is fixed in version 3.11.6.
Severity
9.9 (Critical)
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/patriksimek/vm2/security/advis… | x_refsource_CONFIRM |
| https://github.com/patriksimek/vm2/commit/7e3faaf… | x_refsource_MISC |
| https://github.com/patriksimek/vm2/releases/tag/3.11.6 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| patriksimek | vm2 |
Affected:
< 3.11.6
|
{
"containers": {
"cna": {
"affected": [
{
"product": "vm2",
"vendor": "patriksimek",
"versions": [
{
"status": "affected",
"version": "\u003c 3.11.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-exposed host function that throws an error with that object as its cause and then execute arbitrary host commands. This issue is fixed in version 3.11.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:54:39.406Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m283-3h24-438v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m283-3h24-438v"
},
{
"name": "https://github.com/patriksimek/vm2/commit/7e3faaf550f4ab975bf4cdde183fcec49b056d8e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/patriksimek/vm2/commit/7e3faaf550f4ab975bf4cdde183fcec49b056d8e"
},
{
"name": "https://github.com/patriksimek/vm2/releases/tag/3.11.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/patriksimek/vm2/releases/tag/3.11.6"
}
],
"source": {
"advisory": "GHSA-m283-3h24-438v",
"discovery": "UNKNOWN"
},
"title": "vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47686",
"datePublished": "2026-08-17T20:54:39.406Z",
"dateReserved": "2026-05-19T21:18:20.403Z",
"dateUpdated": "2026-08-17T20:54:39.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47698 (GCVE-0-2026-47698)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:53 – Updated: 2026-08-17 20:53
VLAI
EPSS
VEX
Title
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
Summary
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and reach e.constructor.constructor for arbitrary host command execution. This issue is fixed in version 3.11.6.
Severity
9.8 (Critical)
CWE
- CWE-913 - Improper Control of Dynamically-Managed Code Resources
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/patriksimek/vm2/security/advis… | x_refsource_CONFIRM |
| https://github.com/patriksimek/vm2/commit/a85acb6… | x_refsource_MISC |
| https://github.com/patriksimek/vm2/releases/tag/3.11.6 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| patriksimek | vm2 |
Affected:
< 3.11.6
|
{
"containers": {
"cna": {
"affected": [
{
"product": "vm2",
"vendor": "patriksimek",
"versions": [
{
"status": "affected",
"version": "\u003c 3.11.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic\u0027s prototype chain and reach e.constructor.constructor for arbitrary host command execution. This issue is fixed in version 3.11.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-913",
"description": "CWE-913: Improper Control of Dynamically-Managed Code Resources",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:53:09.218Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cfcw-xp6x-25gj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cfcw-xp6x-25gj"
},
{
"name": "https://github.com/patriksimek/vm2/commit/a85acb61f81402c6eabf32760aa11272af6d0f9e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/patriksimek/vm2/commit/a85acb61f81402c6eabf32760aa11272af6d0f9e"
},
{
"name": "https://github.com/patriksimek/vm2/releases/tag/3.11.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/patriksimek/vm2/releases/tag/3.11.6"
}
],
"source": {
"advisory": "GHSA-cfcw-xp6x-25gj",
"discovery": "UNKNOWN"
},
"title": "vm2: Sandbox Breakout Using Dangerous Host Proto Mutators"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47698",
"datePublished": "2026-08-17T20:53:09.218Z",
"dateReserved": "2026-05-19T21:18:20.404Z",
"dateUpdated": "2026-08-17T20:53:09.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34398 (GCVE-0-2026-34398)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:51 – Updated: 2026-08-17 20:51
VLAI
EPSS
VEX
Title
FreeCAD: Arbitrary Code Execution via eval() on untrusted project file metadata in BIM Workbench
Summary
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval(), allowing arbitrary Python code execution when a user loads a malicious BIM project template. This issue is fixed in version 1.1.1.
Severity
7.8 (High)
CWE
- CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/FreeCAD/FreeCAD/security/advis… | x_refsource_CONFIRM |
| https://github.com/FreeCAD/FreeCAD/pull/28610 | x_refsource_MISC |
| https://github.com/FreeCAD/FreeCAD/commit/871ee19… | x_refsource_MISC |
| https://github.com/FreeCAD/FreeCAD/commit/9ed351c… | x_refsource_MISC |
| https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.1 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "FreeCAD",
"vendor": "FreeCAD",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.19, \u003c 1.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval(), allowing arbitrary Python code execution when a user loads a malicious BIM project template. This issue is fixed in version 1.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:51:56.717Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-8rfj-7956-6gwf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-8rfj-7956-6gwf"
},
{
"name": "https://github.com/FreeCAD/FreeCAD/pull/28610",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FreeCAD/FreeCAD/pull/28610"
},
{
"name": "https://github.com/FreeCAD/FreeCAD/commit/871ee19b76224910332bbfbd39eebbede967998b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FreeCAD/FreeCAD/commit/871ee19b76224910332bbfbd39eebbede967998b"
},
{
"name": "https://github.com/FreeCAD/FreeCAD/commit/9ed351cc4700db0a94c46f020c34c58bbf1bdaba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FreeCAD/FreeCAD/commit/9ed351cc4700db0a94c46f020c34c58bbf1bdaba"
},
{
"name": "https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.1"
}
],
"source": {
"advisory": "GHSA-8rfj-7956-6gwf",
"discovery": "UNKNOWN"
},
"title": "FreeCAD: Arbitrary Code Execution via eval() on untrusted project file metadata in BIM Workbench"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34398",
"datePublished": "2026-08-17T20:51:56.717Z",
"dateReserved": "2026-03-27T13:45:29.620Z",
"dateUpdated": "2026-08-17T20:51:56.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34399 (GCVE-0-2026-34399)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:50 – Updated: 2026-08-17 20:50
VLAI
EPSS
VEX
Title
FreeCAD: Arbitrary Code Execution via eval() on untrusted SVG template scale field in BIM TechDraw Page
Summary
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable code is in src/Mod/BIM/bimcommands/BimTDPage.py (line 87). This issue is fixed in version 1.1.1.
Severity
7.8 (High)
CWE
- CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeCAD/FreeCAD/security/advis… | x_refsource_CONFIRM |
| https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.1 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "FreeCAD",
"vendor": "FreeCAD",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.19, \u003c 1.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD\u0027s BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable code is in src/Mod/BIM/bimcommands/BimTDPage.py (line 87). This issue is fixed in version 1.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:50:19.829Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-chv4-vm6r-wjqj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-chv4-vm6r-wjqj"
},
{
"name": "https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.1"
}
],
"source": {
"advisory": "GHSA-chv4-vm6r-wjqj",
"discovery": "UNKNOWN"
},
"title": "FreeCAD: Arbitrary Code Execution via eval() on untrusted SVG template scale field in BIM TechDraw Page"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34399",
"datePublished": "2026-08-17T20:50:19.829Z",
"dateReserved": "2026-03-27T13:45:29.620Z",
"dateUpdated": "2026-08-17T20:50:19.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34789 (GCVE-0-2026-34789)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:47 – Updated: 2026-08-17 20:47
VLAI
EPSS
VEX
Title
FreeCAD: Arbitrary code execution via unsandboxed PyImport_ImportModule in PropertyPythonObject::Restore
Summary
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.
Severity
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/FreeCAD/FreeCAD/security/advis… | x_refsource_CONFIRM |
| https://github.com/FreeCAD/FreeCAD/commit/81b7392… | x_refsource_MISC |
| https://github.com/FreeCAD/FreeCAD/commit/983037f… | x_refsource_MISC |
| https://github.com/FreeCAD/FreeCAD/commit/e2dc6c8… | x_refsource_MISC |
| https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "FreeCAD",
"vendor": "FreeCAD",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:47:52.373Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-493w-pp4h-h77v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-493w-pp4h-h77v"
},
{
"name": "https://github.com/FreeCAD/FreeCAD/commit/81b73925ce22610542367301d8eff4259eb9596e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FreeCAD/FreeCAD/commit/81b73925ce22610542367301d8eff4259eb9596e"
},
{
"name": "https://github.com/FreeCAD/FreeCAD/commit/983037f3003dc31f48db36705b86fb3fbe026295",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FreeCAD/FreeCAD/commit/983037f3003dc31f48db36705b86fb3fbe026295"
},
{
"name": "https://github.com/FreeCAD/FreeCAD/commit/e2dc6c8172673642c6856b8b3a5a6accefb18279",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FreeCAD/FreeCAD/commit/e2dc6c8172673642c6856b8b3a5a6accefb18279"
},
{
"name": "https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2"
}
],
"source": {
"advisory": "GHSA-493w-pp4h-h77v",
"discovery": "UNKNOWN"
},
"title": "FreeCAD: Arbitrary code execution via unsandboxed PyImport_ImportModule in PropertyPythonObject::Restore"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34789",
"datePublished": "2026-08-17T20:47:52.373Z",
"dateReserved": "2026-03-30T19:54:55.556Z",
"dateUpdated": "2026-08-17T20:47:52.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65822 (GCVE-0-2026-65822)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:45 – Updated: 2026-08-17 20:45
VLAI
EPSS
VEX
Title
ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0.
Severity
7.6 (High)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/55721 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/29dd6e66… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/f43af662… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.23.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.116.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.23.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:45:45.647Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-x35x-4mvx-h959",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-x35x-4mvx-h959"
},
{
"name": "https://github.com/frappe/erpnext/pull/55721",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/55721"
},
{
"name": "https://github.com/frappe/erpnext/commit/29dd6e6681d20bbacb69517d2d2c875aa929eb9e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/29dd6e6681d20bbacb69517d2d2c875aa929eb9e"
},
{
"name": "https://github.com/frappe/erpnext/commit/f43af6624610e874e61ad3faf8701e5e6be6271a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/f43af6624610e874e61ad3faf8701e5e6be6271a"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.116.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.116.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.23.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.23.0"
}
],
"source": {
"advisory": "GHSA-x35x-4mvx-h959",
"discovery": "UNKNOWN"
},
"title": "ERPNext: SQL Injection in \"Inactive Customers\" report via unvalidated `doctype` filter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65822",
"datePublished": "2026-08-17T20:45:45.647Z",
"dateReserved": "2026-07-22T23:16:47.752Z",
"dateUpdated": "2026-08-17T20:45:45.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65974 (GCVE-0-2026-65974)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:44 – Updated: 2026-08-17 20:44
VLAI
EPSS
VEX
Title
ERPNext: Server-Side Template Injection leading to Remote Code Execution
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.
Severity
9.9 (Critical)
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/529d190a2… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.22.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.111.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:44:20.818Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-w996-r7v3-87wr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-w996-r7v3-87wr"
},
{
"name": "https://github.com/frappe/frappe/commit/529d190a252863672164d10bfcd91d1de0ac1c7c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/529d190a252863672164d10bfcd91d1de0ac1c7c"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.111.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.111.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.22.0"
}
],
"source": {
"advisory": "GHSA-w996-r7v3-87wr",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Server-Side Template Injection leading to Remote Code Execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65974",
"datePublished": "2026-08-17T20:44:20.818Z",
"dateReserved": "2026-07-23T18:15:14.580Z",
"dateUpdated": "2026-08-17T20:44:20.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54356 (GCVE-0-2026-54356)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:32 – Updated: 2026-08-17 20:32
VLAI
EPSS
VEX
Title
Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
Summary
Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.
Severity
7.1 (High)
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Budibase/budibase/security/adv… | x_refsource_CONFIRM |
| https://github.com/Budibase/budibase/releases/tag… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "budibase",
"vendor": "Budibase",
"versions": [
{
"status": "affected",
"version": "\u003c 3.41.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:32:05.691Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Budibase/budibase/security/advisories/GHSA-6x9p-4r67-5gjx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-6x9p-4r67-5gjx"
},
{
"name": "https://github.com/Budibase/budibase/releases/tag/3.41.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Budibase/budibase/releases/tag/3.41.3"
}
],
"source": {
"advisory": "GHSA-6x9p-4r67-5gjx",
"discovery": "UNKNOWN"
},
"title": "Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54356",
"datePublished": "2026-08-17T20:32:05.691Z",
"dateReserved": "2026-06-12T19:23:22.318Z",
"dateUpdated": "2026-08-17T20:32:05.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35219 (GCVE-0-2026-35219)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:28 – Updated: 2026-08-17 20:28
VLAI
EPSS
VEX
Title
Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
Summary
Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. This issue is fixed in version 3.41.3.
Severity
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Budibase/budibase/security/adv… | x_refsource_CONFIRM |
| https://github.com/Budibase/budibase/pull/19328 | x_refsource_MISC |
| https://github.com/Budibase/budibase/commit/cc075… | x_refsource_MISC |
| https://github.com/Budibase/budibase/releases/tag… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "budibase",
"vendor": "Budibase",
"versions": [
{
"status": "affected",
"version": "\u003c 3.41.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. This issue is fixed in version 3.41.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:28:40.828Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Budibase/budibase/security/advisories/GHSA-5fpj-28rv-84r7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-5fpj-28rv-84r7"
},
{
"name": "https://github.com/Budibase/budibase/pull/19328",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Budibase/budibase/pull/19328"
},
{
"name": "https://github.com/Budibase/budibase/commit/cc07563a6b0fc0f91c51aae295952b1295546a90",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Budibase/budibase/commit/cc07563a6b0fc0f91c51aae295952b1295546a90"
},
{
"name": "https://github.com/Budibase/budibase/releases/tag/3.41.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Budibase/budibase/releases/tag/3.41.3"
}
],
"source": {
"advisory": "GHSA-5fpj-28rv-84r7",
"discovery": "UNKNOWN"
},
"title": "Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35219",
"datePublished": "2026-08-17T20:28:40.828Z",
"dateReserved": "2026-04-01T18:48:58.938Z",
"dateUpdated": "2026-08-17T20:28:40.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73410 (GCVE-0-2026-73410)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:27 – Updated: 2026-08-17 22:01
VLAI
EPSS
VEX
Title
Budibase: SSRF via DNS rebinding in the REST datasource integration
Summary
Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.
Severity
8.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 21:59 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Budibase/budibase/security/adv… | x_refsource_CONFIRM |
| https://github.com/Budibase/budibase/commit/5758b… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73410",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T21:59:12.000334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T22:01:01.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "budibase",
"vendor": "Budibase",
"versions": [
{
"status": "affected",
"version": "\u003c 3.40.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:27:24.080Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435"
},
{
"name": "https://github.com/Budibase/budibase/commit/5758bdb242802ca20c4ed0dc579e4330ee898ef3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Budibase/budibase/commit/5758bdb242802ca20c4ed0dc579e4330ee898ef3"
}
],
"source": {
"advisory": "GHSA-v42f-v8xc-j435",
"discovery": "UNKNOWN"
},
"title": "Budibase: SSRF via DNS rebinding in the REST datasource integration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73410",
"datePublished": "2026-08-17T20:27:24.080Z",
"dateReserved": "2026-08-12T14:32:11.795Z",
"dateUpdated": "2026-08-17T22:01:01.232Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64657 (GCVE-0-2026-64657)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:24 – Updated: 2026-08-17 20:24
VLAI
EPSS
VEX
Title
Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
Summary
Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.
Severity
8.4 (High)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Budibase/budibase/security/adv… | x_refsource_CONFIRM |
| https://github.com/Budibase/budibase/commit/67572… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "budibase",
"vendor": "Budibase",
"versions": [
{
"status": "affected",
"version": "\u003c 3.39.19"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:24:59.700Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Budibase/budibase/security/advisories/GHSA-qqf5-x7mj-v43p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-qqf5-x7mj-v43p"
},
{
"name": "https://github.com/Budibase/budibase/commit/67572a82c3850964f388bfd969779dc025a80224",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Budibase/budibase/commit/67572a82c3850964f388bfd969779dc025a80224"
}
],
"source": {
"advisory": "GHSA-qqf5-x7mj-v43p",
"discovery": "UNKNOWN"
},
"title": "Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-64657",
"datePublished": "2026-08-17T20:24:59.700Z",
"dateReserved": "2026-07-20T17:11:30.896Z",
"dateUpdated": "2026-08-17T20:24:59.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73560 (GCVE-0-2026-73560)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:17 – Updated: 2026-08-17 20:17
VLAI
EPSS
VEX
Title
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
Summary
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections and allowing server-side requests and reads of arbitrary files accessible to the vLLM process. This issue is fixed in version 0.26.0.
Severity
6.5 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/vllm-project/vllm/security/adv… | x_refsource_CONFIRM |
| https://github.com/vllm-project/vllm/pull/43117 | x_refsource_MISC |
| https://github.com/vllm-project/vllm/commit/54503… | x_refsource_MISC |
| https://github.com/vllm-project/vllm/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vllm-project | vllm |
Affected:
< 0.26.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "vllm",
"vendor": "vllm-project",
"versions": [
{
"status": "affected",
"version": "\u003c 0.26.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections and allowing server-side requests and reads of arbitrary files accessible to the vLLM process. This issue is fixed in version 0.26.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:17:25.769Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vllm-project/vllm/security/advisories/GHSA-4hhp-h66f-j5j7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-4hhp-h66f-j5j7"
},
{
"name": "https://github.com/vllm-project/vllm/pull/43117",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vllm-project/vllm/pull/43117"
},
{
"name": "https://github.com/vllm-project/vllm/commit/54503ecec0f3ac31e5ecfc5f28652e4cc42307b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vllm-project/vllm/commit/54503ecec0f3ac31e5ecfc5f28652e4cc42307b5"
},
{
"name": "https://github.com/vllm-project/vllm/releases/tag/v0.26.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vllm-project/vllm/releases/tag/v0.26.0"
}
],
"source": {
"advisory": "GHSA-4hhp-h66f-j5j7",
"discovery": "UNKNOWN"
},
"title": "vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73560",
"datePublished": "2026-08-17T20:17:25.769Z",
"dateReserved": "2026-08-12T20:53:46.380Z",
"dateUpdated": "2026-08-17T20:17:25.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71486 (GCVE-0-2026-71486)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:13 – Updated: 2026-08-17 20:13
VLAI
EPSS
VEX
Title
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
Summary
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generate_responses, choices, token_ids, prompt_logprobs, logprobs.content, top_logprobs, and routed_experts structures are processed by OnlineDerenderer and tokenizer.decode before max_model_len, max_tokens, max_num_seqs, or response-size limits are enforced, allowing an authenticated API client to consume excessive CPU and memory and produce oversized responses. This issue is fixed in version 0.26.0.
Severity
4.3 (Medium)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/vllm-project/vllm/security/adv… | x_refsource_CONFIRM |
| https://github.com/vllm-project/vllm/pull/47260 | x_refsource_MISC |
| https://github.com/vllm-project/vllm/commit/8e61b… | x_refsource_MISC |
| https://github.com/vllm-project/vllm/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vllm-project | vllm |
Affected:
< 0.26.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "vllm",
"vendor": "vllm-project",
"versions": [
{
"status": "affected",
"version": "\u003c 0.26.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generate_responses, choices, token_ids, prompt_logprobs, logprobs.content, top_logprobs, and routed_experts structures are processed by OnlineDerenderer and tokenizer.decode before max_model_len, max_tokens, max_num_seqs, or response-size limits are enforced, allowing an authenticated API client to consume excessive CPU and memory and produce oversized responses. This issue is fixed in version 0.26.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:13:06.289Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vllm-project/vllm/security/advisories/GHSA-8737-qx52-hjff",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-8737-qx52-hjff"
},
{
"name": "https://github.com/vllm-project/vllm/pull/47260",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vllm-project/vllm/pull/47260"
},
{
"name": "https://github.com/vllm-project/vllm/commit/8e61b646e2d157f9b93451fa048f9c8530c8a67b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vllm-project/vllm/commit/8e61b646e2d157f9b93451fa048f9c8530c8a67b"
},
{
"name": "https://github.com/vllm-project/vllm/releases/tag/v0.26.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vllm-project/vllm/releases/tag/v0.26.0"
}
],
"source": {
"advisory": "GHSA-8737-qx52-hjff",
"discovery": "UNKNOWN"
},
"title": "vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71486",
"datePublished": "2026-08-17T20:13:06.289Z",
"dateReserved": "2026-08-06T19:56:23.725Z",
"dateUpdated": "2026-08-17T20:13:06.289Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57233 (GCVE-0-2026-57233)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:10 – Updated: 2026-08-17 20:10
VLAI
EPSS
VEX
Title
Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
Summary
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.
Severity
8.1 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/notepad-plus-plus/notepad-plus… | x_refsource_CONFIRM |
| https://github.com/notepad-plus-plus/wingup/pull/106 | x_refsource_MISC |
| https://github.com/notepad-plus-plus/wingup/commi… | x_refsource_MISC |
| https://github.com/notepad-plus-plus/notepad-plus… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| notepad-plus-plus | notepad-plus-plus |
Affected:
< 8.9.7
|
{
"containers": {
"cna": {
"affected": [
{
"product": "notepad-plus-plus",
"vendor": "notepad-plus-plus",
"versions": [
{
"status": "affected",
"version": "\u003c 8.9.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:10:37.698Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-hjxw-84rf-wg5r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-hjxw-84rf-wg5r"
},
{
"name": "https://github.com/notepad-plus-plus/wingup/pull/106",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/notepad-plus-plus/wingup/pull/106"
},
{
"name": "https://github.com/notepad-plus-plus/wingup/commit/7670296a5c7fdec624e0a45dbde51059a7d735a8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/notepad-plus-plus/wingup/commit/7670296a5c7fdec624e0a45dbde51059a7d735a8"
},
{
"name": "https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.7"
}
],
"source": {
"advisory": "GHSA-hjxw-84rf-wg5r",
"discovery": "UNKNOWN"
},
"title": "Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57233",
"datePublished": "2026-08-17T20:10:37.698Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-08-17T20:10:37.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52886 (GCVE-0-2026-52886)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:09 – Updated: 2026-08-17 20:09
VLAI
EPSS
VEX
Title
Notepad++: session.xml backupFilePath starts_with Bypass
Summary
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::starts_with against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode restoration to read an arbitrary user-readable file outside the backup directory into an editor tab. This issue is fixed in version 8.9.7.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/notepad-plus-plus/notepad-plus… | x_refsource_CONFIRM |
| https://github.com/notepad-plus-plus/notepad-plus… | x_refsource_MISC |
| https://github.com/notepad-plus-plus/notepad-plus… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| notepad-plus-plus | notepad-plus-plus |
Affected:
< 8.9.7
|
{
"containers": {
"cna": {
"affected": [
{
"product": "notepad-plus-plus",
"vendor": "notepad-plus-plus",
"versions": [
{
"status": "affected",
"version": "\u003c 8.9.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::starts_with against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode restoration to read an arbitrary user-readable file outside the backup directory into an editor tab. This issue is fixed in version 8.9.7."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:09:32.188Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-rqfm-pw34-r7j6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-rqfm-pw34-r7j6"
},
{
"name": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/7e66f36db666a13b09fb5c31232ab2ca1c2ebccc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/7e66f36db666a13b09fb5c31232ab2ca1c2ebccc"
},
{
"name": "https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.7"
}
],
"source": {
"advisory": "GHSA-rqfm-pw34-r7j6",
"discovery": "UNKNOWN"
},
"title": "Notepad++: session.xml backupFilePath starts_with Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-52886",
"datePublished": "2026-08-17T20:09:32.188Z",
"dateReserved": "2026-06-08T21:44:27.365Z",
"dateUpdated": "2026-08-17T20:09:32.188Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}