CVE Notifier

CVE-2026-92596 CWE-400 7.5

Nodemailer before 9.1.0 Denial of Service via addressparser

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attac…

cve.org nodemailer:nodemailer 6 hari lalu

CVE-2026-92595 CWE-73 5.9

Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent

Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message content is resolved through the public plugin API `MailMessage.res…

cve.org nodemailer:nodemailer 6 hari lalu

CVE-2026-92594 CWE-200 7.5

Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers() (usergroups.*:read),…

cve.org craftcms:cms 6 hari lalu

CVE-2026-92593 CWE-94 8.8

Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sink remained unsandboxed, and the same fix commit added a se…

cve.org craftcms:cms 6 hari lalu

CVE-2026-92592 CWE-1336 8.8

Craft CMS before 4.18.6 Remote Code Execution via signed cookie

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC sig…

cve.org craftcms:cms · craftcms:cms 6 hari lalu

CVE-2026-92591 CWE-636 5.9

Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed productio…

cve.org craftcms:cms 6 hari lalu

CVE-2026-92590 CWE-79 5.4

Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inje…

cve.org craftcms:cms 6 hari lalu

CVE-2026-92589 CWE-862 4.3

Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder

Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries (but without…

cve.org craftcms:cms 6 hari lalu

CVE-2026-92588 CWE-639 4.4

n8n before 1.123.76 Improper Authorization via Source Control Push

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request …

cve.org n8n-io:n8n · n8n-io:n8n · n8n-io:n8n 6 hari lalu

CVE-2026-92587 CWE-426 5.0

n8n before 1.123.76 Sandbox Escape via Git Relative URL

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its workin…

cve.org n8n-io:n8n · n8n-io:n8n · n8n-io:n8n 6 hari lalu

CVE-2026-92586 CWE-862 4.3

AVideo through 29.0 Missing Authorization via comment API endpoint

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and grou…

cve.org WWBN:AVideo 6 hari lalu

CVE-2026-92585 CWE-862 4.3

AVideo through 29.0 Missing Authorization Check via API Like Endpoint

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted video…

cve.org WWBN:AVideo 6 hari lalu