๐จ CVE-2024-37325
Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability
๐@cveNotify
Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability
๐@cveNotify
๐จ CVE-2024-35260
An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.
๐@cveNotify
An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.
๐@cveNotify
๐จ CVE-2026-57956
SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.
๐@cveNotify
SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.
๐@cveNotify
GitHub
[security] cross-organization IDOR on alert rules (read/edit/delete by UUID, no org scoping) ยท Issue #11830 ยท SigNoz/signoz
(I've reported the following cross-org IDOR via email on 13 June 2026 with no response) The rule store predicates (pkg/ruler/rulestore/sqlrulestore/rule.go) filter on id only: GetStoredRule (~1...
๐จ CVE-2026-0487
SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system.
๐@cveNotify
SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system.
๐@cveNotify
๐จ CVE-2026-50337
Incorrect type conversion or cast in Windows Notification allows an authorized attacker to elevate privileges locally.
๐@cveNotify
Incorrect type conversion or cast in Windows Notification allows an authorized attacker to elevate privileges locally.
๐@cveNotify
๐จ CVE-2026-50339
Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.
๐@cveNotify
Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.
๐@cveNotify
๐จ CVE-2026-50346
Improper authorization in RPC Runtime allows an authorized attacker to elevate privileges locally.
๐@cveNotify
Improper authorization in RPC Runtime allows an authorized attacker to elevate privileges locally.
๐@cveNotify
๐จ CVE-2026-45806
Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in backend/src/app/rpc/commands/media.clj, where media/download-image in backend/src/app/media.clj used the shared HTTP client without destination filtering, allowing an authenticated file editor to reach internal-only endpoints. This issue is fixed in version 2.15.0.
๐@cveNotify
Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in backend/src/app/rpc/commands/media.clj, where media/download-image in backend/src/app/media.clj used the shared HTTP client without destination filtering, allowing an authenticated file editor to reach internal-only endpoints. This issue is fixed in version 2.15.0.
๐@cveNotify
GitHub
Release 2.15.0 ยท penpot/penpot
โจ New features & Enhancements
Add MCP server integration Github #9174
Add chunked upload API for large media and binary files (removes previous upload size limits) Github #9516
Add anonymous t...
Add MCP server integration Github #9174
Add chunked upload API for large media and binary files (removes previous upload size limits) Github #9516
Add anonymous t...
๐จ CVE-2026-50148
Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4.
๐@cveNotify
Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4.
๐@cveNotify
GitHub
Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
## Summary
A Metabase user with permission to add or edit a database connection โ typically an administrator โ can achieve remote code execution on the Metabase server by configuring a Snowflake...
A Metabase user with permission to add or edit a database connection โ typically an administrator โ can achieve remote code execution on the Metabase server by configuring a Snowflake...
๐จ CVE-2026-62685
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() when Signup=true and CreateUserDir=true, but the many-to-one normalization can collapse usernames such as team/one, team one, and team-one to the same home directory without checking whether the resulting scope is already taken, allowing a second registrant to gain full read and write access to another user's files. This issue is fixed in version 2.63.17.
๐@cveNotify
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() when Signup=true and CreateUserDir=true, but the many-to-one normalization can collapse usernames such as team/one, team one, and team-one to the same home directory without checking whether the resulting scope is already taken, allowing a second registrant to gain full read and write access to another user's files. This issue is fixed in version 2.63.17.
๐@cveNotify
GitHub
fix(auth): reject signup when normalized home dir collides (GHSA-7rc3โฆ ยท filebrowser/filebrowser@883a36f
โฆ-g7h6-22m7)
cleanUsername is many-to-one, so distinct usernames (e.g. "teamone/x" and
"teamone-x") can normalize to the same home directory. With CreateUserDir...
cleanUsername is many-to-one, so distinct usernames (e.g. "teamone/x" and
"teamone-x") can normalize to the same home directory. With CreateUserDir...
๐จ CVE-2026-49997
SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in surrealdb/core/src/doc/delete.rs automatically removed graph edge records with permissions disabled through opt.clone().with_perms(false) when a connected node was deleted, bypassing the edge table's PERMISSIONS FOR delete and PERMISSIONS FOR select clauses. This issue is fixed in version 3.1.0.
๐@cveNotify
SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in surrealdb/core/src/doc/delete.rs automatically removed graph edge records with permissions disabled through opt.clone().with_perms(false) when a connected node was deleted, bypassing the edge table's PERMISSIONS FOR delete and PERMISSIONS FOR select clauses. This issue is fixed in version 3.1.0.
๐@cveNotify
GitHub
[SEC]: Fix vulnerability with data access due to perm check order (#5) ยท surrealdb/surrealdb@500f406
A scalable, distributed, collaborative, document-graph database, for the realtime web - [SEC]: Fix vulnerability with data access due to perm check order (#5) ยท surrealdb/surrealdb@500f406
๐จ CVE-2026-61643
FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-<victim_toolset_app_id>/<tool_name>. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5.
๐@cveNotify
FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-<victim_toolset_app_id>/<tool_name>. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5.
๐@cveNotify
GitHub
Release v4.15.0-beta5 ยท labring/FastGPT
๐ฆ ๅ็บงๆๅ
1. ไฟฎๆน็ฏๅขๅ้
fastgpt ๅ fastgpt-pro ๅขๅ ็ฏๅขๅ้ CHAT_TITLE_MODEL๏ผ็จไบ่ชๅจ็ๆๅฏน่ฏ็ๆ ้ข๏ผไพๅฆ๏ผ
CHAT_TITLE_MODEL=deepseek-v4-flash
2. ้ๅๅๆด
ๆดๆฐ fastgpt-app(fastgpt ไธปๆๅก) ้ๅ tag: v4.15.0-beta5
ๆดๆฐ fastgpt-pro(fastgpt ๅ...
1. ไฟฎๆน็ฏๅขๅ้
fastgpt ๅ fastgpt-pro ๅขๅ ็ฏๅขๅ้ CHAT_TITLE_MODEL๏ผ็จไบ่ชๅจ็ๆๅฏน่ฏ็ๆ ้ข๏ผไพๅฆ๏ผ
CHAT_TITLE_MODEL=deepseek-v4-flash
2. ้ๅๅๆด
ๆดๆฐ fastgpt-app(fastgpt ไธปๆๅก) ้ๅ tag: v4.15.0-beta5
ๆดๆฐ fastgpt-pro(fastgpt ๅ...
๐จ CVE-2026-38753
A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
๐@cveNotify
A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
๐@cveNotify
๐จ CVE-2026-52887
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.
๐@cveNotify
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.
๐@cveNotify
GitHub
fix(plugin-notification-in-app-message): validate channel timestamp fโฆ ยท nocobase/nocobase@68d64e3
โฆilter (#9630)
๐จ CVE-2026-38752
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
๐@cveNotify
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
๐@cveNotify