Security advisories

high2026-10-07

CVE-2026-61428-PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

View chart →

mervinpraison/praisonai · GHSA-qj9c-59p6-8cgx

high2026-10-07

CVE-2026-57449-Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

View chart →

actualbudget/actual · GHSA-m62c-5q34-f3cf

medium2026-10-07

CVE-2026-46438-wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

View chart →

wger-project/wger · GHSA-rjpf-7pf5-q54x

high2026-10-07

CVE-2026-46434-wger: Trainer Privilege Escalation - Improper Privilege Management

View chart →

wger-project/wger · GHSA-x249-cx55-2h87

medium2026-10-07

CVE-2026-46437-wger: API credentials remain valid after logout/password change

View chart →

wger-project/wger · GHSA-v3x9-6gg8-c2c9

medium2026-10-07

CVE-2026-45161-wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding

View chart →

wger-project/wger · GHSA-xf64-4pmc-h8qf

high2026-10-07

CVE-2026-43976-wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

View chart →

wger-project/wger · GHSA-c72h-82w6-rqfp

high2026-10-06

CVE-2026-41510-Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

View chart →

corazawaf/coraza · GHSA-6r3q-mjv7-xr8m

medium2026-10-06

CVE-2026-41508-Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

View chart →

corazawaf/coraza · GHSA-r3rm-qphw-hh76

medium2026-10-06

CVE-2026-41504-Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

View chart →

corazawaf/coraza · GHSA-prpw-wwv7-xjjr

high2026-10-06

CVE-2026-86540-knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json

View chart →

knowns-dev/knowns · GHSA-mc52-mwq4-vfx3

high2026-10-06

CVE-2026-105855-Payload didn't enforce field-level password update restrictions

View chart →

payloadcms/payload · GHSA-fx49-4h83-wjv9

high2026-10-06

CVE-2026-105854-Payload: ReDoS in Multipart Content-Type Validation

View chart →

payloadcms/payload · GHSA-2g7p-5934-q4w7

high2026-10-06

CVE-2026-105849-Payload vulnerable to API key disclosure through ordinary document reads

View chart →

payloadcms/payload · GHSA-238x-w2j9-gwwr

high2026-10-06

CVE-2026-105850-Payload Ecommerce has an order confirmation validation issue

View chart →

payloadcms/payload · GHSA-8r29-2mp2-pmrw

medium2026-10-06

CVE-2026-105852-Payload relationship-query authorization bypass

View chart →

payloadcms/payload · GHSA-7c34-32v3-j575

high2026-10-06

CVE-2026-105853-Payload: Token refresh and password reset responses may expose restricted user fields

View chart →

payloadcms/payload · GHSA-xgv3-crq2-6f69

critical2026-10-06

CVE-2026-105851-Payload: Field access control bypass on auth collections

View chart →

payloadcms/payload · GHSA-vc4h-q48j-5hcx

medium2026-10-06

CVE-2026-105848-Payload: Insufficient Access Control in Stripe REST Proxy

View chart →

payloadcms/payload · GHSA-r9v2-gg2j-22q5

high2026-10-06

CVE-2026-105806-Payload: Improper access control for MCP API keys

View chart →

payloadcms/payload · GHSA-2q76-m6w6-qgc6