CVE-2026-48282: Adobe ColdFusion Path Traversal Vulnerability
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
Advisories tracked
21,453
● Live advisory feed
Security Advisory Fusion for CSIRTs, SOCs & Defenders
Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.
Known exploited
1,787
Sources online
24
Last sync
49M AGO
CVE-2026-56290: Joomlack Page Builder Improper Access Control Vulnerability
Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.
Multiple vulnerabilities in Microsoft Azure Linux (July 7, 2026)
Multiple vulnerabilities have been discovered in Microsoft Azure Linux. They allow an attacker to cause an unspecified security issue by the vendor.
Vulnerability in Mozilla Firefox for iOS (July 7, 2026)
A vulnerability has been discovered in Mozilla Firefox for iOS. It allows an attacker to bypass the security policy.
Multiple vulnerabilities in Microsoft Edge (July 7, 2026)
Multiple vulnerabilities have been discovered in Microsoft Edge. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and a breach of data confidentiality.
Vulnerability in Synacor Zimbra Collaboration (July 7, 2026)
A vulnerability has been discovered in Synacor Zimbra Collaboration. It allows an attacker to cause a remote indirect code injection (XSS).
Multiple vulnerabilities in SPIP (July 7, 2026)
Multiple vulnerabilities have been discovered in SPIP. Some of them allow an attacker to cause a breach of data confidentiality, a SQL injection (SQLi), and a remote indirect code injection (XSS).
Multiple vulnerabilities in PHP (July 7, 2026)
Multiple vulnerabilities have been discovered in PHP. They allow an attacker to cause an unspecified security issue by the vendor.
DSA-6383-1 imagemagick - security update
Multiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. https://se…
CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
Multiple vulnerabilities in Postfix (July 7, 2026)
Multiple vulnerabilities have been discovered in Postfix. They allow an attacker to cause a denial of service and an unspecified security issue by the vendor.
DSA-6382-1 postfix - security update
Multiple security vulnerabilities were discovered in the Postfix mail transport agent, which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6382-1
CVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
GHSA-pmfc-4wjj-gmhx: cut: -s ignored in -z -d '' newline-delimiter mode
cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered. printf 'ab…
GHSA-r9hw-mj3w-phcq: mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)
uutils calls mknod *before* setting the SELinux context (GNU uses setfscreatecon first, labeling atomically). If set_selinux_security_context fails, cleanup uses std::fs::remove_dir, which cannot remove device nodes or FIFOs, leaving the mislabeled node behind. Impact: on SELinu…
GHSA-pmf6-rcx4-v53v: mkfifo: permissions of an existing file are changed after FIFO creation fails
When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644). $ touch secret; chmod 000 secre…
GHSA-qrwj-vh9x-gw5v: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write
Summary agentConn.apiClient() used the default redirect behavior of http.Client while its custom transport dialed the host from the request URL as long as the port was the workspace agent HTTP API port (4). Agent tailnet IPs are deterministic from agent UUIDs, so a malicious wor…
GHSA-cgfv-jrfp-2r7v: OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export
Summary The datapoint export API builds a PostgreSQL crosstab export query by concatenating asset display names into raw SQL. An authenticated user who can create or rename an asset and then request a crosstab datapoint export can inject SQL through the asset name. The injected …
GHSA-473p-56xx-vg67: Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)
Summary In Kiwi TCMS the fields TestCase.extra_link and TestPlan.extra_link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site sc…
GHSA-7cfm-pqrj-xgq7: 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header
Summary The 9router dashboard login rate limiter derives the client identity from the attacker-controlled X-Forwarded-For HTTP header. When 9router is directly exposed, or deployed behind a reverse proxy that does not overwrite untrusted forwarding headers, a remote attacker can…
GHSA-qvfm-67h2-2qfx: 9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover
Summary The /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which onl…
GHSA-f74w-488g-8x5r: Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
Requirements: - Control panel access - Permissions to edit an entry Details Control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header. The issue happens when a user is saving entries. Strings for a signed redirect URL …
GHSA-xrqc-p465-2xvg: Craft CMS: Stored XSS via Structure entry title in table view
Stored XSS via Structure entry title in table view Summary An Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry…
GHSA-287w-mxq6-x2cp: Craft CMS: Sensitive File Disclosure / Server-Side File Read
The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and …
GHSA-24x4-j6x9-rfw5: Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
Summary An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s cont…
GHSA-hmj5-jm8h-h9fh: Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint
Summary An open redirect vulnerability in the account confirmation endpoint allows an unauthenticated attacker to craft a URL hosted on a legitimate Kiwi TCMS instance that redirects victims to an arbitrary external domain. The attack surface is particularly relevant for phishin…
GHSA-ww9q-8r59-xv46: Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness
Summary A soundness vulnerability in the variable-base scalar multiplication gadget of halo2_gadgets allowed a malicious prover to produce a valid proof for an Orchard Action with an *under-constrained* base point. Because this gadget enforces the diversified-address-integrity c…
GHSA-2pq5-3q89-j7cc: Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879
Neo4jChatAgent passes LLM-generated Cypher queries straight to the Neo4j driver with no validation, no statement-type allowlist, and no opt-out gate. The query text is influenceable by prompt injection (direct user input or indirect content the agent reads back via RAG), so an at…
GHSA-vjc7-jrh9-9j86: 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats
title: Unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats product: 9Router version: <= 0.4.41 severity: critical cve_request: true Summary Multiple critical API security vulnerabilities were discovered in 9Router's Next.js dashboard. The /api/prov…
GHSA-5wg6-jmq2-53pw: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
Summary Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the workspace was resolved by ID without confirming the URL's username matched the real owner, while the CORS middlewar…
GHSA-798h-hpph-m24j: Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command
Summary When a check plugin places user provided input inside a command which is passed to shell_exec, an attacker can abuse this to run arbitrary commands. This is mainly dangerous for plugins which are listed in the sudoers file, because this allows an attacker controlling the …
GHSA-7qw2-f75v-62f7: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component
Summary The AgentLogLine dashboard component instantiated ansi-to-html without escapeXML: true and inserted the result via dangerouslySetInnerHTML so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metachar…
GHSA-84rm-42xw-mx52: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration
Summary The AI Bridge Proxy (aibridgeproxyd) created a goproxy server whose default transport set InsecureSkipVerify: true and only assigned a secure transport when an upstream proxy was configured. In the default configuration (no upstream proxy), outbound HTTPS to the Coder ac…
GHSA-wqxv-w64v-5wh6: Suspended Coder users retain access to AI Bridge LLM proxy endpoints
Summary AI Bridge proxy endpoints authenticate via Server.IsAuthorized in coderd/aibridgedserver, which validates key format, expiry, secret and deleted or system users but does not check whether the account is suspended. Because suspension does not revoke existing API keys, a s…
GHSA-f5vp-w269-392g: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints
Summary AI Bridge provider handlers read request bodies with io.ReadAll without a maximum size so an authenticated user with AI Bridge access could send an arbitrarily large body and exhaust memory. Note: Exploitation requires authenticated access to the AI Bridge endpoints and…
GHSA-jqj2-x4c5-jfxm: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers
Summary The devcontainer recreate endpoint relied on route middleware that checked only ActionRead on the workspace and, unlike the sibling delete endpoint, performed no ActionUpdate check before triggering the destructive rebuild. Note: Exploitation requires an existing low-pr…
GHSA-x9qq-2qh5-8rxf: Coder's sub-agent app registration bypasses template port-sharing policy enforcement
Summary The CreateSubAgent RPC did not validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum. Note: Exploitation requires the ability to registe…
GHSA-v54h-cp2w-9x4g: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps
Summary coder open app opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSION_TOKEN placeholder the CLI replaces it with the user's real session token before handing the URL to the OS open handler. Note: Practical…
GHSA-2mg2-p7r7-g27f: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service
Summary POST /api/v2/files converts zip uploads to tar in memory via CreateTarFromZip, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. Note: Exploitation requires authenticated file-upload acce…
GHSA-5g4w-3vw9-478w: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access
Summary The workspace app proxy resolves the target app from httpapi.RequestHost() which prefers the X-Forwarded-Host header over the real Host header. No middleware strips X-Forwarded-Host before routing and the header is not browser-forbidden so client-side JavaScript can set …
GHSA-wrq8-fcv5-8hvp: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
Summary The tailnet coordinator validates that an agent's Addresses derive from its authenticated UUID but applies no equivalent check to AllowedIPs. The coordinator forwards agent-supplied AllowedIPs verbatim to tunnel peers which install them into the WireGuard peer configurat…
GHSA-9rjw-3gwp-f59v: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
Summary UpsertWorkspaceApp overwrites an existing app's agent_id on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob payload without verifying it belongs to the workspace being built. CompleteJob runs under dbauthz.AsProvisionerd so…
GHSA-f962-qm93-mj4c: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service
Summary NewDataBuilder in provisionersdk/proto/dataupload.go allocated a byte slice using the client-supplied FileSize from a DataUpload message without an upper-bound check. Although the DRPC wire limit is 4 MiB, the FileSize value itself was unconstrained Impact An authentic…
GHSA-mcqq-fqgf-rxwm: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
Summary coder config-ssh wrote server-supplied SSH settings (HostnameSuffix, SSHConfigOptions) into the user's ~/.ssh/config without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration. Note:…
GHSA-29xf-69gq-m9jx: Coder: User-admin role can reset owner account password
Summary The PUT /api/v2/users/{user}/password endpoint authorized only ActionUpdatePersonal and did not prevent a user-admin from resetting an owner account's password. It also did not require the current password when an admin reset another user's password. Note: Exploitation …
GHSA-9r87-mvcw-x35f: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
Summary Two flaws in Coder's OIDC login chained into account takeover: email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the email_verified claim was only enforced when present as a boolean false so an ab…
GHSA-75vm-6w67-gwvp: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
Summary Coder's OIDC callback checked email_verified with a direct Go bool type assertion. When an IdP returned the claim as a non-boolean (for example the string "false") or omitted it, the assertion failed open and the email was treated as verified. Combined with an unconditio…
CVE-2026-14471 - Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry
Bulletin ID: 2026-052-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/06/2026 13:45 PM PDT Description: Amazon mcp-gateway-registry is an open-source gateway and registry for Model Context Protocol (MCP) servers, providing centralized discovery, a…
GHSA-7v6w-c3f4-9wpq: OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
Summary The fix for CVE-2026-40882 addressed only the Velbus asset import handler. The KNX asset import handler (KNXProtocol) processes user-uploaded ETS project ZIP files through Saxon XSLT and XMLInputFactory.newInstance() with no XXE protection, allowing any authenticated user…
GHSA-xqr9-4wvv-gvch: OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl
Summary A realm admin of tenant B can read the profile, client roles, and realm roles of any user in any other realm (including the master realm) by supplying the target user's UUID in the REST API path. Three read endpoints in UserResourceImpl check whether the caller holds the…