Reserved but Public CVEs

First seen Mar 18, 2026

First seen Mar 18, 2026

First seen Mar 18, 2026

First seen Mar 18, 2026

First seen Mar 18, 2026

CVE-2020-4326 is a transport security weakness in HCL AppScan Enterprise affecting the security rules update administration section of the web application console. The application does not set the HTTP Strict-Transport-Security (HSTS) header for that interface, allowing browsers to access the affected functionality without being forced to use HTTPS on subsequent connections. This weakens protection against protocol downgrade and interception scenarios on untrusted networks.

CVE-2020-4326First seen Aug 23, 2026

CVE-2026-32257 is a stored cross-site scripting vulnerability in the Winter CMS backend module’s custom styles handling. The flaw affects backend branding and related custom style functionality where user-supplied CSS/LESS is compiled and rendered across backend pages. Insufficient sanitization allows malicious content embedded in custom styles, including cached LESS compiler output, to persist and be served to other users. Available reporting indicates the issue also involved incomplete sanitization when reading cached renderCss() output, enabling previously poisoned cache entries to continue rendering unsafe content. The vulnerability can affect backend pages broadly, including administrative interface views and, after cache priming, certain backend authentication-related pages.

CVE-2026-32257First seen Aug 13, 2026

CVE-2026-32258 is a stored cross-site scripting vulnerability in the Winter CMS backend module affecting custom editor and branding style handling. The flaw stems from insufficient sanitization of compiled LESS/CSS output in backend style rendering, including incomplete handling of cached renderCss() output. An authenticated backend user with elevated editor or branding-related permissions can inject malicious markup through custom style configuration, causing attacker-controlled content to be stored and later rendered in backend pages. Available information indicates the issue affected backend pages broadly and, after cache priming, could also impact backend authentication-related pages such as sign-in, password restore, and password reset views.

CVE-2026-32258First seen Aug 13, 2026

CVE-2026-54167 is a vulnerability in the Pipelines-as-Code GitHub App provider in which the webhook handling logic improperly trusted the X-GitHub-Enterprise-Host header before validating the webhook signature. By supplying a crafted webhook request with an attacker-controlled Enterprise host value, an unauthenticated attacker able to reach the webhook endpoint could cause the controller to generate a locally signed GitHub App JWT and send it to an attacker-controlled host. The flaw stems from using untrusted request metadata to influence security-sensitive token generation and outbound communication prior to establishing the authenticity of the webhook payload. Successful exploitation can expose GitHub App credentials that can then be used to obtain installation access tokens within the JWT validity period, constrained by the affected installation's configured scope and permissions.

CVE-2026-54167First seen Aug 21, 2026

CVE-2026-55468 is an improper access control vulnerability in the Wagtail Pages admin API. Vulnerable implementations fail to correctly enforce page-level restrictions when handling admin API requests, allowing authenticated Wagtail admin users to access draft and live page fields that should not be exposed to them. Exposed data can include standard page metadata such as title, slug, SEO-related fields, search description, and custom fields explicitly declared in api_fields. The issue affects the Pages admin API query handling rather than ordinary public site page delivery, and stems from insufficient restriction of the queryset used by the admin API endpoints.

CVE-2026-55468First seen Aug 21, 2026

CVE-2026-54180 is an insecure direct object reference vulnerability in Laravel Backpack CRUD. Query scopes intended to enforce row-level restrictions, including multi-tenant or per-user isolation implemented through addClause() or addBaseClause(), can be bypassed during Update, Delete, and Reorder operations. As a result, the application may resolve and act on records by primary key without consistently applying the expected tenant or ownership constraints. An authenticated low-privilege user who can supply or predict another record identifier can perform unauthorized modifications against records outside their authorized scope.

CVE-2026-54180First seen Aug 21, 2026

CVE-2026-54162 is an improper neutralization of terminal escape and control sequences vulnerability in Ember's interactive text user interface when rendering Caddy access log fields. Attacker-controlled data originating from HTTP requests to a monitored Caddy server can be written into access logs and then displayed by Ember without sufficient sanitization, allowing terminal control sequences to be interpreted by the operator's terminal emulator instead of being rendered as inert text. The issue affects interactive TUI usage and enables terminal injection through remotely supplied, unauthenticated input reflected in log content.

CVE-2026-54162First seen Aug 21, 2026

CVE-2026-54156 is a denial-of-service vulnerability in node-opcua caused by an unbounded global nonce cache. An unauthenticated remote attacker can repeatedly initiate OPC UA session establishment, causing nonces to accumulate without sufficient eviction or expiration. This results in uncontrolled heap memory growth in the server process. The vulnerable condition is associated with session-opening activity and insufficient resource-limiting logic for cached nonce values, allowing repeated network requests to consume memory until the process becomes unstable or crashes.

CVE-2026-54156First seen Aug 21, 2026

CVE-2026-63179 is a local file inclusion vulnerability in Winter CMS arising from LESS compilation used by customizable backend stylesheets and theme assets. Authenticated backend users with relevant permissions can inject malicious @import directives into controllable stylesheet inputs, causing the LESS processor to resolve and include arbitrary local files readable by the PHP process. The issue affects backend customization paths including custom CSS and HTML custom style settings, where user-supplied stylesheet content reaches import-capable compilation sinks without sufficient restriction on import roots. Winter core and Winter Storm version 1.2.13 address the issue by introducing a safe LESS import resolver and by restricting or disabling unsafe import behavior in affected code paths.

CVE-2026-63179First seen Aug 21, 2026

CVE-2026-54176 is an account management vulnerability in Laravel Backpack CRUD affecting the account information update flow implemented by MyAccountController::postAccountInfoForm. The flaw allows an authenticated user to change the login email address associated with an account without verifying the current password before the change is accepted. Because the email address functions as the account recovery and authentication identifier, an attacker who obtains temporary or otherwise unauthorized access to a victim account can replace the registered email address and later use the password reset mechanism to regain access and fully take over the account.

CVE-2026-54176First seen Aug 21, 2026

CVE-2026-54245 is a SQL injection vulnerability in Fleet's Okta conditional access integration. In affected Fleet Premium deployments with this integration enabled, an attacker who controls a single enrolled host can inject SQL through the integration workflow and gain unauthorized access to the Fleet backend database. Successful exploitation allows arbitrary reading and modification of database records, including sensitive authentication material such as session tokens. By leveraging exposed session data, an attacker may escalate privileges to global administrator level and use Fleet administrative capabilities to issue actions to managed endpoints.

CVE-2026-54245First seen Aug 21, 2026

CVE-2026-54182 is an OS command injection vulnerability in Laravel Backpack CRUD. The flaw is in Backpack\CRUD\Stats::makeCurlRequest, where attacker-controlled input from the HTTP Host header is incorporated into shell command construction. Because the vulnerable implementation invokes an operating system command using insufficiently neutralized external input, a remote unauthenticated attacker can inject arbitrary shell metacharacters and execute commands on the underlying server. The issue affects vulnerable Laravel Backpack CRUD releases prior to the patched versions that replaced the shell-based request logic with a Guzzle-based implementation.

CVE-2026-54182First seen Aug 21, 2026

CVE-2026-54155 is an authentication flaw in node-opcua affecting UserNameIdentityToken processing. The implementation fails to verify that the trailing bytes of the decrypted password blob match the expected session nonce before extracting and accepting the password value. As a result, an attacker can craft a token whose decrypted password field is interpreted as an empty string and can also replay previously captured authentication tokens across sessions because the session-binding nonce is not enforced. The issue breaks the intended freshness and integrity guarantees of the OPC UA username/password authentication flow and can permit unauthorized authentication under affected configurations.

CVE-2026-54155First seen Aug 21, 2026

CVE-2026-55451 is a prototype pollution vulnerability in the js2i18next() function of gettext-converter. The flaw arises when crafted translation keys are processed as dynamic object paths without rejecting dangerous key segments such as __proto__, constructor, or prototype. By supplying malicious translation data, an attacker can modify Object.prototype and thereby influence object behavior across the JavaScript runtime. This can destabilize application logic and create conditions for broader security impact depending on how polluted properties are later consumed.

CVE-2026-55451First seen Aug 21, 2026

CVE-2026-55149 is an unauthenticated remote denial-of-service vulnerability in vouch-proxy caused by unbounded memory allocation during multipart cookie reassembly. The flaw affects logic that parses multipart cookie names on authentication-related endpoints such as /validate and /_external-auth-:id. An attacker can supply a crafted multipart cookie name containing an invalid or excessively large part count, which is then used directly in allocation for cookie-part storage without adequate bounds checking or format validation. This can trigger massive memory allocation and cause the process to terminate from out-of-memory conditions.

CVE-2026-55149First seen Aug 21, 2026

CVE-2026-54181 is a stored cross-site scripting vulnerability in Laravel Backpack CRUD. The issue affects the color column template, where values are rendered unescaped by default because the escaped and unescaped Blade rendering branches are inverted in the color.blade.php logic. As a result, attacker-controlled data stored in a color-typed column can be emitted into the generated HTML without proper output encoding when users view the list interface. This enables persistent script execution in the browser of any user who loads the affected page.

CVE-2026-54181First seen Aug 21, 2026

CVE-2026-63202 is an unauthenticated denial-of-service vulnerability in netty-incubator-codec-bhttp and netty-incubator-codec-ohttp affecting BinaryHttpParser during Binary HTTP field-section decoding. The flaw is caused by an infinite loop condition in parser logic that continues processing while the remaining field-section length is not equal to zero, rather than only while it is greater than zero. When a crafted Binary HTTP message causes field-line parsing to make no forward progress, the parser can loop indefinitely instead of terminating with a framing error. Additional unsafe handling includes failure to treat null or zero-progress returns from field-line parsing as fatal errors, insufficient rejection of field lines that consume more than the declared field-section length, and reliance on assert-based invariant checks rather than explicit exception handling. Successful exploitation allows a remote attacker to trigger an infinite loop before business-logic processing occurs.

CVE-2026-63202First seen Aug 21, 2026

CVE-2026-54178 is an arbitrary file deletion vulnerability in Laravel Backpack CRUD affecting the file-handling logic in HasUploadFields::uploadMultipleFilesToDisk. The flaw arises because attacker-controlled clear_<attr>[] input is not validated to ensure that requested deletions correspond only to files associated with the current model record. As a result, a user who can submit update requests to a vulnerable Backpack CRUD instance can cause the application to delete files under the configured storage disk root that are outside the intended scope of the edited record.

CVE-2026-54178First seen Aug 21, 2026

CVE-2026-55244 is a sandbox escape vulnerability in asteval affecting applications that evaluate attacker-controlled expressions through asteval.Interpreter.eval(). The issue arises because attacker-supplied expressions can raise Python BaseException subclasses such as SystemExit, KeyboardInterrupt, and GeneratorExit. These exceptions are not caught by handlers that only intercept Exception, allowing them to propagate outside the intended sandbox boundary. In practice, this breaks the assumption that evaluated expressions remain safely contained within the interpreter and can cause abnormal control-flow transfer into the host application.

CVE-2026-55244First seen Aug 21, 2026

CVE-2026-54177 is an unrestricted file upload vulnerability in Laravel Backpack CRUD. The vulnerable upload handling improperly preserves or permits server-executable file extensions, allowing authenticated administrators to upload executable files into web-accessible storage. In affected deployments, the issue is associated with upload processing in components such as HasUploadFields and FileNameGenerator, where insufficient restriction of dangerous extensions can allow a malicious upload to be stored in a location that the web server can execute. If application-level validation is absent and uploaded content is exposed through public storage, the flaw can be leveraged to execute attacker-supplied code on the server.

CVE-2026-54177First seen Aug 21, 2026