Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
17866 vulnerabilities
CVE-2026-45377 (GCVE-0-2026-45377)
Vulnerability from cvelistv5 – Published: 2026-07-31 22:58 – Updated: 2026-07-31 23:37
VLAI
EPSS
VEX
Title
Decidim: Private exports can be downloaded through reusable links
Summary
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. This is because Decidim::DownloadYourDataController#download_file authenticates the export owner but redirects to a signed Active Storage blob URL that is no longer bound to the owner session. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/decidim/decidim/security/advis… | x_refsource_CONFIRM |
| https://github.com/decidim/decidim/pull/16680 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45377",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T23:37:12.595782Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T23:37:39.654Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/decidim/decidim/security/advisories/GHSA-767h-63j4-5226"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "decidim",
"vendor": "decidim",
"versions": [
{
"status": "affected",
"version": "\u003c 0.30.9"
},
{
"status": "affected",
"version": "\u003e= 0.31.0.rc1, \u003c 0.31.5"
},
{
"status": "affected",
"version": "\u003e= 0.32.0.rc1, \u003c 0.32.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. This is because Decidim::DownloadYourDataController#download_file authenticates the export owner but redirects to a signed Active Storage blob URL that is no longer bound to the owner session. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T22:58:22.730Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/decidim/decidim/security/advisories/GHSA-767h-63j4-5226",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/decidim/decidim/security/advisories/GHSA-767h-63j4-5226"
},
{
"name": "https://github.com/decidim/decidim/pull/16680",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/decidim/decidim/pull/16680"
}
],
"source": {
"advisory": "GHSA-767h-63j4-5226",
"discovery": "UNKNOWN"
},
"title": "Decidim: Private exports can be downloaded through reusable links"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45377",
"datePublished": "2026-07-31T22:58:22.730Z",
"dateReserved": "2026-05-12T00:51:29.086Z",
"dateUpdated": "2026-07-31T23:37:39.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45376 (GCVE-0-2026-45376)
Vulnerability from cvelistv5 – Published: 2026-07-31 22:34 – Updated: 2026-07-31 22:34
VLAI
EPSS
VEX
Title
Decidim: Admin user search allows SQL injection through similarity-based sorting
Summary
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
Severity
5.5 (Medium)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/decidim/decidim/security/advis… | x_refsource_CONFIRM |
| https://github.com/decidim/decidim/commit/2733595… | x_refsource_MISC |
| https://github.com/decidim/decidim/commit/e4d21b4… | x_refsource_MISC |
| https://github.com/decidim/decidim/commit/f3817fa… | x_refsource_MISC |
| https://github.com/decidim/decidim/releases/tag/v0.30.9 | x_refsource_MISC |
| https://github.com/decidim/decidim/releases/tag/v0.31.5 | x_refsource_MISC |
| https://github.com/decidim/decidim/releases/tag/v… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "decidim",
"vendor": "decidim",
"versions": [
{
"status": "affected",
"version": "\u003c 0.30.9"
},
{
"status": "affected",
"version": "\u003e= 0.31.0.rc1, \u003c 0.31.5"
},
{
"status": "affected",
"version": "\u003e= 0.32.0.rc1, \u003c 0.32.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T22:34:27.181Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37"
},
{
"name": "https://github.com/decidim/decidim/commit/27335957b363516e23919a9006812f1c458c88e0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/decidim/decidim/commit/27335957b363516e23919a9006812f1c458c88e0"
},
{
"name": "https://github.com/decidim/decidim/commit/e4d21b41fb462d9436035a043962a4090f2cc240",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/decidim/decidim/commit/e4d21b41fb462d9436035a043962a4090f2cc240"
},
{
"name": "https://github.com/decidim/decidim/commit/f3817fac448a4e3facd6bcb346167048b3421124",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/decidim/decidim/commit/f3817fac448a4e3facd6bcb346167048b3421124"
},
{
"name": "https://github.com/decidim/decidim/releases/tag/v0.30.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/decidim/decidim/releases/tag/v0.30.9"
},
{
"name": "https://github.com/decidim/decidim/releases/tag/v0.31.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/decidim/decidim/releases/tag/v0.31.5"
},
{
"name": "https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2"
}
],
"source": {
"advisory": "GHSA-jvqq-cvh4-xm37",
"discovery": "UNKNOWN"
},
"title": "Decidim: Admin user search allows SQL injection through similarity-based sorting"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45376",
"datePublished": "2026-07-31T22:34:27.181Z",
"dateReserved": "2026-05-12T00:51:29.086Z",
"dateUpdated": "2026-07-31T22:34:27.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54785 (GCVE-0-2026-54785)
Vulnerability from cvelistv5 – Published: 2026-07-31 22:31 – Updated: 2026-07-31 22:31
VLAI
EPSS
VEX
Title
gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode
Summary
gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1.
Severity
6.2 (Medium)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/eLyiN/gemini-bridge/security/a… | x_refsource_CONFIRM |
| https://github.com/eLyiN/gemini-bridge/pull/9 | x_refsource_MISC |
| https://github.com/eLyiN/gemini-bridge/commit/8f3… | x_refsource_MISC |
| https://github.com/eLyiN/gemini-bridge/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| eLyiN | gemini-bridge |
Affected:
>= 1.0.0, < 1.3.1
|
{
"containers": {
"cna": {
"affected": [
{
"product": "gemini-bridge",
"vendor": "eLyiN",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "gemini-bridge is a lightweight MCP server bridging AI agents to Google\u0027s Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T22:31:04.190Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/eLyiN/gemini-bridge/security/advisories/GHSA-c5px-58j2-7fqp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/eLyiN/gemini-bridge/security/advisories/GHSA-c5px-58j2-7fqp"
},
{
"name": "https://github.com/eLyiN/gemini-bridge/pull/9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/eLyiN/gemini-bridge/pull/9"
},
{
"name": "https://github.com/eLyiN/gemini-bridge/commit/8f3b85afd02b692c4bc974b5176e12fb277ea801",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/eLyiN/gemini-bridge/commit/8f3b85afd02b692c4bc974b5176e12fb277ea801"
},
{
"name": "https://github.com/eLyiN/gemini-bridge/releases/tag/v1.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/eLyiN/gemini-bridge/releases/tag/v1.3.1"
}
],
"source": {
"advisory": "GHSA-c5px-58j2-7fqp",
"discovery": "UNKNOWN"
},
"title": "gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54785",
"datePublished": "2026-07-31T22:31:04.190Z",
"dateReserved": "2026-06-15T23:23:57.714Z",
"dateUpdated": "2026-07-31T22:31:04.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54768 (GCVE-0-2026-54768)
Vulnerability from cvelistv5 – Published: 2026-07-31 22:24 – Updated: 2026-07-31 22:24
VLAI
EPSS
VEX
Title
WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)
Summary
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.
Severity
CWE
- CWE-204 - Observable Response Discrepancy
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/wp-graphql/wp-graphql/security… | x_refsource_CONFIRM |
| https://github.com/wp-graphql/wp-graphql/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wp-graphql | wp-graphql |
Affected:
< 2.15.1
|
{
"containers": {
"cna": {
"affected": [
{
"product": "wp-graphql",
"vendor": "wp-graphql",
"versions": [
{
"status": "affected",
"version": "\u003c 2.15.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204: Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T22:24:40.639Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv"
},
{
"name": "https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql/v2.15.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql/v2.15.1"
}
],
"source": {
"advisory": "GHSA-jhh7-832h-f8hv",
"discovery": "UNKNOWN"
},
"title": "WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54768",
"datePublished": "2026-07-31T22:24:40.639Z",
"dateReserved": "2026-06-15T23:23:57.713Z",
"dateUpdated": "2026-07-31T22:24:40.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53573 (GCVE-0-2026-53573)
Vulnerability from cvelistv5 – Published: 2026-07-31 22:16 – Updated: 2026-07-31 22:16
VLAI
EPSS
VEX
Title
core-geonetwork has an Open Redirect Bypass
Summary
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11.
Severity
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/geonetwork/core-geonetwork/sec… | x_refsource_CONFIRM |
| https://github.com/geonetwork/core-geonetwork/pull/9307 | x_refsource_MISC |
| https://github.com/geonetwork/core-geonetwork/pull/9309 | x_refsource_MISC |
| https://github.com/geonetwork/core-geonetwork/com… | x_refsource_MISC |
| https://github.com/geonetwork/core-geonetwork/com… | x_refsource_MISC |
| https://github.com/geonetwork/core-geonetwork/rel… | x_refsource_MISC |
| https://github.com/geonetwork/core-geonetwork/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| geonetwork | core-geonetwork |
Affected:
>= 3.12.0, <= 3.12.12
Affected: >= 4.0.0-alpha.1, <= 4.0.6 Affected: >= 4.2.0, < 4.2.16 Affected: >= 4.4.0, < 4.4.11 |
{
"containers": {
"cna": {
"affected": [
{
"product": "core-geonetwork",
"vendor": "geonetwork",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.12.0, \u003c= 3.12.12"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-alpha.1, \u003c= 4.0.6"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.16"
},
{
"status": "affected",
"version": "\u003e= 4.4.0, \u003c 4.4.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T22:16:25.110Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-pjp7-q6wp-97qx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-pjp7-q6wp-97qx"
},
{
"name": "https://github.com/geonetwork/core-geonetwork/pull/9307",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/geonetwork/core-geonetwork/pull/9307"
},
{
"name": "https://github.com/geonetwork/core-geonetwork/pull/9309",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/geonetwork/core-geonetwork/pull/9309"
},
{
"name": "https://github.com/geonetwork/core-geonetwork/commit/0d74f673dfc926bde935819ed34636d789b2fecd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/geonetwork/core-geonetwork/commit/0d74f673dfc926bde935819ed34636d789b2fecd"
},
{
"name": "https://github.com/geonetwork/core-geonetwork/commit/cde9b6481a29e2473b7b74479b4e3fd6843bac4e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/geonetwork/core-geonetwork/commit/cde9b6481a29e2473b7b74479b4e3fd6843bac4e"
},
{
"name": "https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16"
},
{
"name": "https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11"
}
],
"source": {
"advisory": "GHSA-pjp7-q6wp-97qx",
"discovery": "UNKNOWN"
},
"title": "core-geonetwork has an Open Redirect Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53573",
"datePublished": "2026-07-31T22:16:25.110Z",
"dateReserved": "2026-06-09T19:11:53.483Z",
"dateUpdated": "2026-07-31T22:16:25.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45330 (GCVE-0-2026-45330)
Vulnerability from cvelistv5 – Published: 2026-07-31 22:05 – Updated: 2026-07-31 22:05
VLAI
EPSS
VEX
Title
Decidim: Verification admins can access supplied IDs from other organisations
Summary
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant’s ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
Severity
4.9 (Medium)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/decidim/decidim/security/advis… | x_refsource_CONFIRM |
| https://github.com/decidim/decidim/releases/tag/v0.30.9 | x_refsource_MISC |
| https://github.com/decidim/decidim/releases/tag/v0.31.5 | x_refsource_MISC |
| https://github.com/decidim/decidim/releases/tag/v… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "decidim",
"vendor": "decidim",
"versions": [
{
"status": "affected",
"version": "\u003c 0.30.9"
},
{
"status": "affected",
"version": "\u003e= 0.31.0, \u003c 0.31.5"
},
{
"status": "affected",
"version": "\u003e= 0.32.0.rc1, \u003c 0.32.0.rc2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant\u2019s ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T22:05:21.773Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/decidim/decidim/security/advisories/GHSA-86fh-w43w-338c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/decidim/decidim/security/advisories/GHSA-86fh-w43w-338c"
},
{
"name": "https://github.com/decidim/decidim/releases/tag/v0.30.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/decidim/decidim/releases/tag/v0.30.9"
},
{
"name": "https://github.com/decidim/decidim/releases/tag/v0.31.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/decidim/decidim/releases/tag/v0.31.5"
},
{
"name": "https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2"
}
],
"source": {
"advisory": "GHSA-86fh-w43w-338c",
"discovery": "UNKNOWN"
},
"title": "Decidim: Veri\ufb01cation admins can access supplied IDs from other organisations"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45330",
"datePublished": "2026-07-31T22:05:21.773Z",
"dateReserved": "2026-05-11T20:50:30.540Z",
"dateUpdated": "2026-07-31T22:05:21.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54909 (GCVE-0-2026-54909)
Vulnerability from cvelistv5 – Published: 2026-07-31 22:03 – Updated: 2026-07-31 22:03
VLAI
EPSS
VEX
Title
Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute
Summary
pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.
Severity
5.3 (Medium)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pion/stun/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/pion/stun/pull/278 | x_refsource_MISC |
| https://github.com/pion/stun/commit/fa9f074a33a80… | x_refsource_MISC |
| https://github.com/pion/stun/releases/tag/v3.1.3 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "stun",
"vendor": "pion",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T22:03:53.514Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc"
},
{
"name": "https://github.com/pion/stun/pull/278",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pion/stun/pull/278"
},
{
"name": "https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423"
},
{
"name": "https://github.com/pion/stun/releases/tag/v3.1.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pion/stun/releases/tag/v3.1.3"
}
],
"source": {
"advisory": "GHSA-34rh-wp3j-6cxc",
"discovery": "UNKNOWN"
},
"title": "Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54909",
"datePublished": "2026-07-31T22:03:53.514Z",
"dateReserved": "2026-06-16T13:49:33.556Z",
"dateUpdated": "2026-07-31T22:03:53.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54787 (GCVE-0-2026-54787)
Vulnerability from cvelistv5 – Published: 2026-07-31 21:58 – Updated: 2026-07-31 23:36
VLAI
EPSS
VEX
Title
sigstore-go fails to check signature timestamps against a signing key's validity period
Summary
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-324 - Use of a Key Past its Expiration Date
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/sigstore/sigstore-go/security/… | x_refsource_CONFIRM |
| https://github.com/sigstore/sigstore-go/pull/642 | x_refsource_MISC |
| https://github.com/sigstore/sigstore-go/commit/45… | x_refsource_MISC |
| https://github.com/sigstore/sigstore-go/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sigstore | sigstore-go |
Affected:
< 1.2.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54787",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T23:35:40.966529Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T23:36:13.441Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sigstore-go",
"vendor": "sigstore",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-324",
"description": "CWE-324: Use of a Key Past its Expiration Date",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T21:58:14.156Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"
},
{
"name": "https://github.com/sigstore/sigstore-go/pull/642",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sigstore/sigstore-go/pull/642"
},
{
"name": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"
},
{
"name": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"
}
],
"source": {
"advisory": "GHSA-wqqc-jjcq-vfxm",
"discovery": "UNKNOWN"
},
"title": "sigstore-go fails to check signature timestamps against a signing key\u0027s validity period"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54787",
"datePublished": "2026-07-31T21:58:14.156Z",
"dateReserved": "2026-06-15T23:23:57.714Z",
"dateUpdated": "2026-07-31T23:36:13.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45086 (GCVE-0-2026-45086)
Vulnerability from cvelistv5 – Published: 2026-07-31 21:44 – Updated: 2026-07-31 21:44
VLAI
EPSS
VEX
Title
Decidim: Forms admin question editor lacks authorization
Summary
Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.
Severity
5.4 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/decidim/decidim/security/advis… | x_refsource_CONFIRM |
| https://github.com/decidim/decidim/commit/fa52fb6… | x_refsource_MISC |
| https://github.com/decidim/decidim/commit/fc89301… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "decidim",
"vendor": "decidim",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.31.1, \u003c 0.31.5"
},
{
"status": "affected",
"version": "\u003e= 0.32.0.rc1, \u003c 0.32.0.rc2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T21:44:11.803Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/decidim/decidim/security/advisories/GHSA-vq6j-hj8w-7v39",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/decidim/decidim/security/advisories/GHSA-vq6j-hj8w-7v39"
},
{
"name": "https://github.com/decidim/decidim/commit/fa52fb631a0788b30895d1312728a888607d81b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/decidim/decidim/commit/fa52fb631a0788b30895d1312728a888607d81b5"
},
{
"name": "https://github.com/decidim/decidim/commit/fc89301c6697c6101a7aed3fced3fa8311048cb9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/decidim/decidim/commit/fc89301c6697c6101a7aed3fced3fa8311048cb9"
}
],
"source": {
"advisory": "GHSA-vq6j-hj8w-7v39",
"discovery": "UNKNOWN"
},
"title": "Decidim: Forms admin question editor lacks authorization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45086",
"datePublished": "2026-07-31T21:44:11.803Z",
"dateReserved": "2026-05-08T19:27:26.697Z",
"dateUpdated": "2026-07-31T21:44:11.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65981 (GCVE-0-2026-65981)
Vulnerability from cvelistv5 – Published: 2026-07-31 21:00 – Updated: 2026-07-31 21:00
VLAI
EPSS
VEX
Title
Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover
Summary
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim's quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker's session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker's own identity rather than the allocation owner's. This issue is fixed in version 4.15.0.
Severity
7.1 (High)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coturn/coturn/security/advisor… | x_refsource_CONFIRM |
| https://github.com/coturn/coturn/commit/37df05131… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "coturn",
"vendor": "coturn",
"versions": [
{
"status": "affected",
"version": "\u003c 4.15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user\u0027s credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim\u0027s quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker\u0027s session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker\u0027s own identity rather than the allocation owner\u0027s. This issue is fixed in version 4.15.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T21:00:02.893Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/coturn/coturn/security/advisories/GHSA-69wx-x7x6-pjj8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/coturn/coturn/security/advisories/GHSA-69wx-x7x6-pjj8"
},
{
"name": "https://github.com/coturn/coturn/commit/37df0513168f830a7c9ce0a411db0300fa182f05",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/coturn/coturn/commit/37df0513168f830a7c9ce0a411db0300fa182f05"
}
],
"source": {
"advisory": "GHSA-69wx-x7x6-pjj8",
"discovery": "UNKNOWN"
},
"title": "Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65981",
"datePublished": "2026-07-31T21:00:02.893Z",
"dateReserved": "2026-07-23T18:54:15.832Z",
"dateUpdated": "2026-07-31T21:00:02.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53551 (GCVE-0-2026-53551)
Vulnerability from cvelistv5 – Published: 2026-07-31 20:12 – Updated: 2026-07-31 20:12
VLAI
EPSS
VEX
Title
free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure
Summary
free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale causing denial of service for all subscribers attempting authentication through the affected AUSF. This vulnerability is fixed in 1.4.5.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/free5gc/free5gc/security/advis… | x_refsource_CONFIRM |
| https://github.com/free5gc/free5gc/issues/1048 | x_refsource_MISC |
| https://github.com/free5gc/ausf/pull/61 | x_refsource_MISC |
| https://github.com/free5gc/ausf/commit/bfc4a10094… | x_refsource_MISC |
| https://github.com/free5gc/ausf/releases/tag/v1.4.5 | x_refsource_MISC |
| https://github.com/free5gc/free5gc/releases/tag/v4.2.2 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "free5gc",
"vendor": "free5gc",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.2"
}
]
},
{
"product": "ausf",
"vendor": "free5gc",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go\u0027s net/url.Parse() to fail, returning HTTP 500 \"System failure\" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale causing denial of service for all subscribers attempting authentication through the affected AUSF. This vulnerability is fixed in 1.4.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T20:12:57.932Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-qj55-47fp-p62j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-qj55-47fp-p62j"
},
{
"name": "https://github.com/free5gc/free5gc/issues/1048",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/free5gc/free5gc/issues/1048"
},
{
"name": "https://github.com/free5gc/ausf/pull/61",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/free5gc/ausf/pull/61"
},
{
"name": "https://github.com/free5gc/ausf/commit/bfc4a10094dbacbd862baa4686829f3fcc06ce1e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/free5gc/ausf/commit/bfc4a10094dbacbd862baa4686829f3fcc06ce1e"
},
{
"name": "https://github.com/free5gc/ausf/releases/tag/v1.4.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/free5gc/ausf/releases/tag/v1.4.5"
},
{
"name": "https://github.com/free5gc/free5gc/releases/tag/v4.2.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/free5gc/free5gc/releases/tag/v4.2.2"
}
],
"source": {
"advisory": "GHSA-qj55-47fp-p62j",
"discovery": "UNKNOWN"
},
"title": "free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53551",
"datePublished": "2026-07-31T20:12:57.932Z",
"dateReserved": "2026-06-09T18:13:07.263Z",
"dateUpdated": "2026-07-31T20:12:57.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62959 (GCVE-0-2026-62959)
Vulnerability from cvelistv5 – Published: 2026-07-31 19:57 – Updated: 2026-07-31 23:34
VLAI
EPSS
VEX
Title
Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)
Summary
Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed→unsigned conversion. This issue is fixed in version 4.15.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/coturn/coturn/security/advisor… | x_refsource_CONFIRM |
| https://github.com/coturn/coturn/pull/1965 | x_refsource_MISC |
| https://github.com/coturn/coturn/commit/960835886… | x_refsource_MISC |
| https://github.com/coturn/coturn/releases/tag/4.15.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62959",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T23:34:10.861030Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T23:34:33.361Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "coturn",
"vendor": "coturn",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.5.2, \u003c 4.15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect \u003cURL\u003e and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients\u0027 requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed\u2192unsigned conversion. This issue is fixed in version 4.15.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-195",
"description": "CWE-195: Signed to Unsigned Conversion Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:57:06.394Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g"
},
{
"name": "https://github.com/coturn/coturn/pull/1965",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/coturn/coturn/pull/1965"
},
{
"name": "https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4"
},
{
"name": "https://github.com/coturn/coturn/releases/tag/4.15.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/coturn/coturn/releases/tag/4.15.0"
}
],
"source": {
"advisory": "GHSA-m23x-5qf5-988g",
"discovery": "UNKNOWN"
},
"title": "Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62959",
"datePublished": "2026-07-31T19:57:06.394Z",
"dateReserved": "2026-07-14T22:32:17.732Z",
"dateUpdated": "2026-07-31T23:34:33.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53599 (GCVE-0-2026-53599)
Vulnerability from cvelistv5 – Published: 2026-07-31 19:43 – Updated: 2026-07-31 21:39
VLAI
EPSS
VEX
Title
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
Summary
REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/redaxo/core/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/redaxo/core/pull/6538 | x_refsource_MISC |
| https://github.com/redaxo/core/commit/462e36896bb… | x_refsource_MISC |
| https://github.com/redaxo/core/releases/tag/5.21.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53599",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T20:11:41.826930Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T21:39:28.144Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "redaxo",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.18.2, \u003c 5.21.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:43:15.663Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25"
},
{
"name": "https://github.com/redaxo/core/pull/6538",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/redaxo/core/pull/6538"
},
{
"name": "https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340"
},
{
"name": "https://github.com/redaxo/core/releases/tag/5.21.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/redaxo/core/releases/tag/5.21.1"
}
],
"source": {
"advisory": "GHSA-98pp-vccm-qm25",
"discovery": "UNKNOWN"
},
"title": "Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53599",
"datePublished": "2026-07-31T19:43:15.663Z",
"dateReserved": "2026-06-09T19:39:52.404Z",
"dateUpdated": "2026-07-31T21:39:28.144Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62999 (GCVE-0-2026-62999)
Vulnerability from cvelistv5 – Published: 2026-07-31 19:41 – Updated: 2026-07-31 19:59
VLAI
EPSS
VEX
Title
Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)
Summary
Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/copier-org/copier/security/adv… | x_refsource_CONFIRM |
| https://github.com/copier-org/copier/commit/7408f… | x_refsource_MISC |
| https://github.com/copier-org/copier/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| copier-org | copier |
Affected:
>= 9.5.0, <= 9.16.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62999",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T19:59:06.929791Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:59:30.346Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "copier",
"vendor": "copier-org",
"versions": [
{
"status": "affected",
"version": "\u003e= 9.5.0, \u003c= 9.16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-180",
"description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:41:55.494Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch"
},
{
"name": "https://github.com/copier-org/copier/commit/7408f0d6287a7bf452715fd9f25dc54eaba3c295",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/copier-org/copier/commit/7408f0d6287a7bf452715fd9f25dc54eaba3c295"
},
{
"name": "https://github.com/copier-org/copier/releases/tag/v9.17.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/copier-org/copier/releases/tag/v9.17.0"
}
],
"source": {
"advisory": "GHSA-34mv-rjq9-5mch",
"discovery": "UNKNOWN"
},
"title": "Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62999",
"datePublished": "2026-07-31T19:41:55.494Z",
"dateReserved": "2026-07-14T23:10:57.032Z",
"dateUpdated": "2026-07-31T19:59:30.346Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53510 (GCVE-0-2026-53510)
Vulnerability from cvelistv5 – Published: 2026-07-31 19:38 – Updated: 2026-07-31 20:04
VLAI
EPSS
VEX
Title
Savon::Model evaluates WSDL operation names as Ruby source
Summary
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/savonrb/savon/security/advisor… | x_refsource_CONFIRM |
| https://github.com/savonrb/savon/commit/8f22eb543… | x_refsource_MISC |
| https://github.com/savonrb/savon/releases/tag/v2.17.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53510",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T20:04:14.383083Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T20:04:21.069Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "savon",
"vendor": "savonrb",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.9.8, \u003c 2.17.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:38:33.457Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/savonrb/savon/security/advisories/GHSA-mx5j-mp4f-g8jg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/savonrb/savon/security/advisories/GHSA-mx5j-mp4f-g8jg"
},
{
"name": "https://github.com/savonrb/savon/commit/8f22eb543e7436f6247172c9be47e22792d375e9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/savonrb/savon/commit/8f22eb543e7436f6247172c9be47e22792d375e9"
},
{
"name": "https://github.com/savonrb/savon/releases/tag/v2.17.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/savonrb/savon/releases/tag/v2.17.2"
}
],
"source": {
"advisory": "GHSA-mx5j-mp4f-g8jg",
"discovery": "UNKNOWN"
},
"title": "Savon::Model evaluates WSDL operation names as Ruby source"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53510",
"datePublished": "2026-07-31T19:38:33.457Z",
"dateReserved": "2026-06-09T17:05:25.060Z",
"dateUpdated": "2026-07-31T20:04:21.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65841 (GCVE-0-2026-65841)
Vulnerability from cvelistv5 – Published: 2026-07-31 19:16 – Updated: 2026-07-31 20:05
VLAI
EPSS
VEX
Title
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
Summary
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/xdan/jodit/security/advisories… | x_refsource_CONFIRM |
| https://github.com/xdan/jodit/commit/49a31f451f6b… | x_refsource_MISC |
| https://github.com/xdan/jodit/releases/tag/4.13.6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65841",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T20:05:04.456041Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T20:05:10.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "jodit",
"vendor": "xdan",
"versions": [
{
"status": "affected",
"version": "\u003c 4.13.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jodit Editor is a WYSIWYG editor with a built-in file browser \u0026 image editor. Prior to 4.13.6, Jodit\u0027s clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:16:05.952Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p"
},
{
"name": "https://github.com/xdan/jodit/commit/49a31f451f6b686f5610022a1d4406ee85138dc5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xdan/jodit/commit/49a31f451f6b686f5610022a1d4406ee85138dc5"
},
{
"name": "https://github.com/xdan/jodit/releases/tag/4.13.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xdan/jodit/releases/tag/4.13.6"
}
],
"source": {
"advisory": "GHSA-45qg-252v-3f7p",
"discovery": "UNKNOWN"
},
"title": "Jodit has cross-site scripting (XSS) via \u003cscript\u003e nested in SVG that bypasses clean-html sanitization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65841",
"datePublished": "2026-07-31T19:16:05.952Z",
"dateReserved": "2026-07-22T23:16:47.753Z",
"dateUpdated": "2026-07-31T20:05:10.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62324 (GCVE-0-2026-62324)
Vulnerability from cvelistv5 – Published: 2026-07-31 19:08 – Updated: 2026-07-31 19:08
VLAI
EPSS
VEX
Title
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
Summary
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.
Severity
5.4 (Medium)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/xdan/jodit/security/advisories… | x_refsource_CONFIRM |
| https://github.com/xdan/jodit/commit/5fba6ef2381d… | x_refsource_MISC |
| https://github.com/xdan/jodit/releases/tag/4.12.31 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "jodit",
"vendor": "xdan",
"versions": [
{
"status": "affected",
"version": "\u003c 4.12.31"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jodit Editor is a WYSIWYG editor with a built-in file browser \u0026 image editor. Prior to 4.12.31, Jodit\u0027s sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-83",
"description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:08:03.043Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j"
},
{
"name": "https://github.com/xdan/jodit/commit/5fba6ef2381d151d7cb8e3c5ad0b9996af0f97b0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xdan/jodit/commit/5fba6ef2381d151d7cb8e3c5ad0b9996af0f97b0"
},
{
"name": "https://github.com/xdan/jodit/releases/tag/4.12.31",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xdan/jodit/releases/tag/4.12.31"
}
],
"source": {
"advisory": "GHSA-j839-gqq4-gf9j",
"discovery": "UNKNOWN"
},
"title": "Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62324",
"datePublished": "2026-07-31T19:08:03.043Z",
"dateReserved": "2026-07-13T19:27:58.315Z",
"dateUpdated": "2026-07-31T19:08:03.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55825 (GCVE-0-2026-55825)
Vulnerability from cvelistv5 – Published: 2026-07-31 19:07 – Updated: 2026-07-31 23:33
VLAI
EPSS
VEX
Title
Contao: Possible path traversal in job download URIs
Summary
Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The controller authorizes only the jobUuid route parameter. The later attachment lookup joins that authorized job UUID with the attacker-controlled identifier, then passes the combined path to the virtual filesystem. VirtualFilesystem::resolve() canonicalizes the whole path and only rejects paths that escape the filesystem mount, so authorized-job/../victim-job/debug_log.csv becomes victim-job/debug_log.csv. This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/contao/contao/security/advisor… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55825",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T23:33:06.322745Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T23:33:16.171Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "contao",
"vendor": "contao",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.7.0, \u003c 5.7.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The controller authorizes only the jobUuid route parameter. The later attachment lookup joins that authorized job UUID with the attacker-controlled identifier, then passes the combined path to the virtual filesystem. VirtualFilesystem::resolve() canonicalizes the whole path and only rejects paths that escape the filesystem mount, so authorized-job/../victim-job/debug_log.csv becomes victim-job/debug_log.csv. This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:07:40.609Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/contao/contao/security/advisories/GHSA-grm4-wm43-9jh5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/contao/contao/security/advisories/GHSA-grm4-wm43-9jh5"
}
],
"source": {
"advisory": "GHSA-grm4-wm43-9jh5",
"discovery": "UNKNOWN"
},
"title": "Contao: Possible path traversal in job download URIs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55825",
"datePublished": "2026-07-31T19:07:40.609Z",
"dateReserved": "2026-06-17T16:29:38.864Z",
"dateUpdated": "2026-07-31T23:33:16.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55824 (GCVE-0-2026-55824)
Vulnerability from cvelistv5 – Published: 2026-07-31 19:04 – Updated: 2026-07-31 19:58
VLAI
EPSS
VEX
Title
Contao crawler leaks auth credentials to external hosts
Summary
Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony option names basic_auth and bearer_auth instead of Symfony HttpClient's real auth_basic and auth_bearer options. When contao.crawl.default_http_client_options contains Basic or Bearer authentication for a protected staging/production site, those credentials remain in the "clean" client used for external links or configured additional URIs. An attacker who can get an external URL crawled, for example through a link on a crawled page while the broken-link checker is enabled, can receive the crawler credentials. This issue has been fixed in versions 5.3.47 and 5.7.7.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/contao/contao/security/advisor… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55824",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T19:58:23.916842Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:58:42.933Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "contao",
"vendor": "contao",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.13.40, \u003c 5.3.47"
},
{
"status": "affected",
"version": "\u003e= 5.7.0-RC1, \u003c 5.7.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao\u0027s crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony option names basic_auth and bearer_auth instead of Symfony HttpClient\u0027s real auth_basic and auth_bearer options. When contao.crawl.default_http_client_options contains Basic or Bearer authentication for a protected staging/production site, those credentials remain in the \"clean\" client used for external links or configured additional URIs. An attacker who can get an external URL crawled, for example through a link on a crawled page while the broken-link checker is enabled, can receive the crawler credentials. This issue has been fixed in versions 5.3.47 and 5.7.7."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:04:00.322Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/contao/contao/security/advisories/GHSA-3mr9-p497-58f6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/contao/contao/security/advisories/GHSA-3mr9-p497-58f6"
}
],
"source": {
"advisory": "GHSA-3mr9-p497-58f6",
"discovery": "UNKNOWN"
},
"title": "Contao crawler leaks auth credentials to external hosts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55824",
"datePublished": "2026-07-31T19:04:00.322Z",
"dateReserved": "2026-06-17T16:29:38.864Z",
"dateUpdated": "2026-07-31T19:58:42.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53502 (GCVE-0-2026-53502)
Vulnerability from cvelistv5 – Published: 2026-07-31 19:03 – Updated: 2026-07-31 19:18
VLAI
EPSS
VEX
Title
Thumbor has path traversal via post-validation URL decoding bypass in file_loader
Summary
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or frame filter input. This issue is fixed in 7.8.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/thumbor/thumbor/security/advis… | x_refsource_CONFIRM |
| https://github.com/thumbor/thumbor/commit/3b986d1… | x_refsource_MISC |
| https://github.com/thumbor/thumbor/releases/tag/7.8.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53502",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T19:17:57.968026Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:18:09.047Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-cj54-hpcc-gj6h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "thumbor",
"vendor": "thumbor",
"versions": [
{
"status": "affected",
"version": "\u003c 7.8.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or frame filter input. This issue is fixed in 7.8.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:03:16.522Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/thumbor/thumbor/security/advisories/GHSA-cj54-hpcc-gj6h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-cj54-hpcc-gj6h"
},
{
"name": "https://github.com/thumbor/thumbor/commit/3b986d13677b30fe6651c8c72ebb25957ac0a40d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/thumbor/thumbor/commit/3b986d13677b30fe6651c8c72ebb25957ac0a40d"
},
{
"name": "https://github.com/thumbor/thumbor/releases/tag/7.8.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/thumbor/thumbor/releases/tag/7.8.0"
}
],
"source": {
"advisory": "GHSA-cj54-hpcc-gj6h",
"discovery": "UNKNOWN"
},
"title": "Thumbor has path traversal via post-validation URL decoding bypass in file_loader"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53502",
"datePublished": "2026-07-31T19:03:16.522Z",
"dateReserved": "2026-06-09T17:05:25.059Z",
"dateUpdated": "2026-07-31T19:18:09.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53505 (GCVE-0-2026-53505)
Vulnerability from cvelistv5 – Published: 2026-07-31 19:00 – Updated: 2026-07-31 19:00
VLAI
EPSS
VEX
Title
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
Summary
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service. This issue is fixed in 7.8.0.
Severity
7.5 (High)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/thumbor/thumbor/security/advis… | x_refsource_CONFIRM |
| https://github.com/thumbor/thumbor/commit/2c71611… | x_refsource_MISC |
| https://github.com/thumbor/thumbor/releases/tag/7.8.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "thumbor",
"vendor": "thumbor",
"versions": [
{
"status": "affected",
"version": "\u003c 7.8.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor\u0027s filters:proportion(\u003cvalue\u003e) filter does not enforce an upper bound on \u003cvalue\u003e and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service. This issue is fixed in 7.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:00:22.755Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/thumbor/thumbor/security/advisories/GHSA-phj3-59pf-cp83",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-phj3-59pf-cp83"
},
{
"name": "https://github.com/thumbor/thumbor/commit/2c716119de986cfc68c7071af52a98187e006023",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/thumbor/thumbor/commit/2c716119de986cfc68c7071af52a98187e006023"
},
{
"name": "https://github.com/thumbor/thumbor/releases/tag/7.8.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/thumbor/thumbor/releases/tag/7.8.0"
}
],
"source": {
"advisory": "GHSA-phj3-59pf-cp83",
"discovery": "UNKNOWN"
},
"title": "Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53505",
"datePublished": "2026-07-31T19:00:22.755Z",
"dateReserved": "2026-06-09T17:05:25.059Z",
"dateUpdated": "2026-07-31T19:00:22.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53504 (GCVE-0-2026-53504)
Vulnerability from cvelistv5 – Published: 2026-07-31 18:57 – Updated: 2026-07-31 23:31
VLAI
EPSS
VEX
Title
Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
Summary
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/thumbor/thumbor/security/advis… | x_refsource_CONFIRM |
| https://github.com/thumbor/thumbor/commit/3f38fe1… | x_refsource_MISC |
| https://github.com/thumbor/thumbor/releases/tag/7.8.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53504",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T23:31:09.431241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T23:31:37.588Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-5vjc-7cxw-4w6j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "thumbor",
"vendor": "thumbor",
"versions": [
{
"status": "affected",
"version": "\u003c 7.8.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T18:57:19.257Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/thumbor/thumbor/security/advisories/GHSA-5vjc-7cxw-4w6j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-5vjc-7cxw-4w6j"
},
{
"name": "https://github.com/thumbor/thumbor/commit/3f38fe1610d20168e91f76d432212de30727eb2e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/thumbor/thumbor/commit/3f38fe1610d20168e91f76d432212de30727eb2e"
},
{
"name": "https://github.com/thumbor/thumbor/releases/tag/7.8.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/thumbor/thumbor/releases/tag/7.8.0"
}
],
"source": {
"advisory": "GHSA-5vjc-7cxw-4w6j",
"discovery": "UNKNOWN"
},
"title": "Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53504",
"datePublished": "2026-07-31T18:57:19.257Z",
"dateReserved": "2026-06-09T17:05:25.059Z",
"dateUpdated": "2026-07-31T23:31:37.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53503 (GCVE-0-2026-53503)
Vulnerability from cvelistv5 – Published: 2026-07-31 18:54 – Updated: 2026-07-31 21:39
VLAI
EPSS
VEX
Title
Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
Summary
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process, causing a remote denial of service. This issue is fixed in 7.8.0.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/thumbor/thumbor/security/advis… | x_refsource_CONFIRM |
| https://github.com/thumbor/thumbor/commit/447e192… | x_refsource_MISC |
| https://github.com/thumbor/thumbor/releases/tag/7.8.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53503",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T20:14:06.472673Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T21:39:35.108Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-cqjp-jf4r-h5q9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "thumbor",
"vendor": "thumbor",
"versions": [
{
"status": "affected",
"version": "\u003c 7.8.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor\u0027s filters:convolution(\u003cmatrix\u003e, \u003ccolumns\u003e, \u003cshould_normalize\u003e) filter passes the user-controlled \u003ccolumns\u003e value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns \u003e 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process, causing a remote denial of service. This issue is fixed in 7.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-369",
"description": "CWE-369: Divide By Zero",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T18:54:20.747Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/thumbor/thumbor/security/advisories/GHSA-cqjp-jf4r-h5q9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-cqjp-jf4r-h5q9"
},
{
"name": "https://github.com/thumbor/thumbor/commit/447e192e3fb92e64c12e5354a56a4a7133f69d73",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/thumbor/thumbor/commit/447e192e3fb92e64c12e5354a56a4a7133f69d73"
},
{
"name": "https://github.com/thumbor/thumbor/releases/tag/7.8.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/thumbor/thumbor/releases/tag/7.8.0"
}
],
"source": {
"advisory": "GHSA-cqjp-jf4r-h5q9",
"discovery": "UNKNOWN"
},
"title": "Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53503",
"datePublished": "2026-07-31T18:54:20.747Z",
"dateReserved": "2026-06-09T17:05:25.059Z",
"dateUpdated": "2026-07-31T21:39:35.108Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53501 (GCVE-0-2026-53501)
Vulnerability from cvelistv5 – Published: 2026-07-31 18:42 – Updated: 2026-07-31 19:58
VLAI
EPSS
VEX
Title
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
Summary
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation. This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths. This issue is fixed in 7.8.0.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/thumbor/thumbor/security/advis… | x_refsource_CONFIRM |
| https://github.com/thumbor/thumbor/commit/e3ae3e2… | x_refsource_MISC |
| https://github.com/thumbor/thumbor/releases/tag/7.8.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53501",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T19:57:48.500225Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:58:01.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "thumbor",
"vendor": "thumbor",
"versions": [
{
"status": "affected",
"version": "\u003c 7.8.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor\u2019s HMAC validation can be bypassed due to the use of Python\u2019s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation. This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths. This issue is fixed in 7.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T18:42:42.360Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/thumbor/thumbor/security/advisories/GHSA-mw3h-qjxj-6xg9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-mw3h-qjxj-6xg9"
},
{
"name": "https://github.com/thumbor/thumbor/commit/e3ae3e2500537b4d735df4144129a649374bb70b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/thumbor/thumbor/commit/e3ae3e2500537b4d735df4144129a649374bb70b"
},
{
"name": "https://github.com/thumbor/thumbor/releases/tag/7.8.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/thumbor/thumbor/releases/tag/7.8.0"
}
],
"source": {
"advisory": "GHSA-mw3h-qjxj-6xg9",
"discovery": "UNKNOWN"
},
"title": "Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53501",
"datePublished": "2026-07-31T18:42:42.360Z",
"dateReserved": "2026-06-09T17:05:25.059Z",
"dateUpdated": "2026-07-31T19:58:01.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53500 (GCVE-0-2026-53500)
Vulnerability from cvelistv5 – Published: 2026-07-31 18:35 – Updated: 2026-07-31 23:30
VLAI
EPSS
VEX
Title
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
Summary
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0.
Severity
8.2 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/thumbor/thumbor/security/advis… | x_refsource_CONFIRM |
| https://github.com/thumbor/thumbor/commit/6887671… | x_refsource_MISC |
| https://github.com/thumbor/thumbor/releases/tag/7.8.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53500",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T23:29:34.062473Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T23:30:44.046Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "thumbor",
"vendor": "thumbor",
"versions": [
{
"status": "affected",
"version": "\u003c 7.8.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T18:35:54.234Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537"
},
{
"name": "https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7"
},
{
"name": "https://github.com/thumbor/thumbor/releases/tag/7.8.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/thumbor/thumbor/releases/tag/7.8.0"
}
],
"source": {
"advisory": "GHSA-6x26-6r6f-m537",
"discovery": "UNKNOWN"
},
"title": "Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53500",
"datePublished": "2026-07-31T18:35:54.234Z",
"dateReserved": "2026-06-09T17:05:25.059Z",
"dateUpdated": "2026-07-31T23:30:44.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57232 (GCVE-0-2026-57232)
Vulnerability from cvelistv5 – Published: 2026-07-31 18:29 – Updated: 2026-07-31 18:29
VLAI
EPSS
VEX
Title
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
Summary
Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo->read() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this->feedIo->read($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48.
Severity
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/contao/contao/security/advisor… | x_refsource_CONFIRM |
| https://github.com/contao/contao/commit/27f620180… | x_refsource_MISC |
| https://github.com/contao/contao/commit/53b939ff2… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "contao",
"vendor": "contao",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.7.0-RC1, \u003c 5.7.9"
},
{
"status": "affected",
"version": "\u003e= 5.3.35, \u003c 5.3.48"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo-\u003eread() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this-\u003efeedIo-\u003eread($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T18:29:53.924Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh"
},
{
"name": "https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f"
},
{
"name": "https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4"
}
],
"source": {
"advisory": "GHSA-87mg-5grr-rhwh",
"discovery": "UNKNOWN"
},
"title": "Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57232",
"datePublished": "2026-07-31T18:29:53.924Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-07-31T18:29:53.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54737 (GCVE-0-2026-54737)
Vulnerability from cvelistv5 – Published: 2026-07-31 17:48 – Updated: 2026-07-31 19:00
VLAI
EPSS
VEX
Title
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
Summary
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/phun-ky/defaults-deep/security… | x_refsource_CONFIRM |
| https://github.com/phun-ky/defaults-deep/pull/49 | x_refsource_MISC |
| https://github.com/phun-ky/defaults-deep/commit/8… | x_refsource_MISC |
| https://github.com/phun-ky/defaults-deep/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| phun-ky | defaults-deep |
Affected:
< 2.0.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54737",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T18:53:15.831395Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:00:41.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "defaults-deep",
"vendor": "phun-ky",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T17:48:42.670Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh"
},
{
"name": "https://github.com/phun-ky/defaults-deep/pull/49",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/phun-ky/defaults-deep/pull/49"
},
{
"name": "https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059"
},
{
"name": "https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5"
}
],
"source": {
"advisory": "GHSA-mj3g-7xcc-x4vh",
"discovery": "UNKNOWN"
},
"title": "@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54737",
"datePublished": "2026-07-31T17:48:42.670Z",
"dateReserved": "2026-06-15T23:07:33.233Z",
"dateUpdated": "2026-07-31T19:00:41.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54725 (GCVE-0-2026-54725)
Vulnerability from cvelistv5 – Published: 2026-07-31 17:45 – Updated: 2026-07-31 18:58
VLAI
EPSS
VEX
Title
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API
Summary
vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address. This issue is fixed in version 1.23.1.
Severity
9.6 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/bank-vaults/vault-secrets-webh… | x_refsource_CONFIRM |
| https://github.com/bank-vaults/vault-secrets-webh… | x_refsource_MISC |
| https://github.com/bank-vaults/vault-secrets-webh… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bank-vaults | vault-secrets-webhook |
Affected:
< 1.23.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54725",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T18:58:31.264157Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T18:58:46.332Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vault-secrets-webhook",
"vendor": "bank-vaults",
"versions": [
{
"status": "affected",
"version": "\u003c 1.23.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address. This issue is fixed in version 1.23.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T17:45:09.548Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm"
},
{
"name": "https://github.com/bank-vaults/vault-secrets-webhook/commit/76db45976fee0f54cafd94dffa425e6b542f65a0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bank-vaults/vault-secrets-webhook/commit/76db45976fee0f54cafd94dffa425e6b542f65a0"
},
{
"name": "https://github.com/bank-vaults/vault-secrets-webhook/releases/tag/v1.23.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bank-vaults/vault-secrets-webhook/releases/tag/v1.23.1"
}
],
"source": {
"advisory": "GHSA-r2v3-8gwf-7ghm",
"discovery": "UNKNOWN"
},
"title": "vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54725",
"datePublished": "2026-07-31T17:45:09.548Z",
"dateReserved": "2026-06-15T23:07:33.232Z",
"dateUpdated": "2026-07-31T18:58:46.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55100 (GCVE-0-2026-55100)
Vulnerability from cvelistv5 – Published: 2026-07-31 17:03 – Updated: 2026-07-31 19:57
VLAI
EPSS
VEX
Title
hashi-vault-js has a path traversal and query parameter injection
Summary
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kyndryl-open-source/hashi-vaul… | x_refsource_CONFIRM |
| https://github.com/kyndryl-open-source/hashi-vaul… | x_refsource_MISC |
| https://github.com/kyndryl-open-source/hashi-vaul… | x_refsource_MISC |
| https://github.com/kyndryl-open-source/hashi-vaul… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kyndryl-open-source | hashi-vault-js |
Affected:
< 0.5.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55100",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T19:56:47.845036Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:57:01.760Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hashi-vault-js",
"vendor": "kyndryl-open-source",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23: Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T17:03:41.858Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-g956-2f74-rmv7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-g956-2f74-rmv7"
},
{
"name": "https://github.com/kyndryl-open-source/hashi-vault-js/pull/66",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kyndryl-open-source/hashi-vault-js/pull/66"
},
{
"name": "https://github.com/kyndryl-open-source/hashi-vault-js/commit/ea2f76052d366a08f35f62ef4c12b6a334c91ec2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kyndryl-open-source/hashi-vault-js/commit/ea2f76052d366a08f35f62ef4c12b6a334c91ec2"
},
{
"name": "https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2"
}
],
"source": {
"advisory": "GHSA-g956-2f74-rmv7",
"discovery": "UNKNOWN"
},
"title": "hashi-vault-js has a path traversal and query parameter injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55100",
"datePublished": "2026-07-31T17:03:41.858Z",
"dateReserved": "2026-06-16T14:41:54.579Z",
"dateUpdated": "2026-07-31T19:57:01.760Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54729 (GCVE-0-2026-54729)
Vulnerability from cvelistv5 – Published: 2026-07-31 16:58 – Updated: 2026-07-31 17:31
VLAI
EPSS
VEX
Title
dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
Summary
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery. This issue is fixed in version 1.0.5.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/HackingRepo/dssrf-js/security/… | x_refsource_CONFIRM |
| https://github.com/HackingRepo/dssrf-js/pull/102 | x_refsource_MISC |
| https://github.com/HackingRepo/dssrf-js/commit/66… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackingRepo | dssrf-js |
Affected:
< 1.0.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54729",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T17:30:46.420965Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T17:31:00.320Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-5846-7qm3-r52j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dssrf-js",
"vendor": "HackingRepo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery. This issue is fixed in version 1.0.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T16:58:56.571Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-5846-7qm3-r52j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-5846-7qm3-r52j"
},
{
"name": "https://github.com/HackingRepo/dssrf-js/pull/102",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/HackingRepo/dssrf-js/pull/102"
},
{
"name": "https://github.com/HackingRepo/dssrf-js/commit/668c21792cd1252baf779a176aa652e2b4c0067d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/HackingRepo/dssrf-js/commit/668c21792cd1252baf779a176aa652e2b4c0067d"
}
],
"source": {
"advisory": "GHSA-5846-7qm3-r52j",
"discovery": "UNKNOWN"
},
"title": "dssrf: any users using 1.1.1.1 DNS is impacted by SSRF"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54729",
"datePublished": "2026-07-31T16:58:56.571Z",
"dateReserved": "2026-06-15T23:07:33.232Z",
"dateUpdated": "2026-07-31T17:31:00.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}