Reserved but Public CVEs

CVE-2026-55846 is a path traversal vulnerability in the built-in HTTP server used by Allure Report's `allure serve` and `allure open` functionality. Based on the provided advisory, the server fails to properly constrain requested paths to the intended report directory, allowing crafted request paths to traverse outside the served content root and access arbitrary files readable by the Allure process. The issue affects `io.qameta.allure:allure-commandline` prior to 2.39.0.

CVE-2026-55846First seen Jun 20, 2026

A stored cross-site scripting vulnerability affects the StarCitizenWiki EmbedVideo extension when $wgEmbedVideoRequireConsent is enabled, which the advisory states is the default configuration. The flaw allows HTML/JavaScript injection through a malformed video src URL or ID, leading to attacker-controlled content being embedded into generated markup, including event handler attributes. An attacker with the ability to edit a wiki page can store a malicious payload that is later rendered in the context of the wiki origin when other users view the affected page.

CVE-2026-55692First seen Jun 20, 2026

NL Portal Backend Libraries contain unauthenticated GraphQL form-definition resolvers that accept a caller-supplied Objecten-API URL and cause the backend to fetch that URL on the configured Objecten-API host while forwarding a privileged Objecten-API token. This creates a constrained server-side request forgery condition combined with missing authorization on the resolver. According to the provided advisory, affected functionality includes `getFormDefinitionByObjectenApiUrl` and deprecated `getFormDefinitionById`. The issue is constrained because outbound requests are limited to the configured Objecten-API host, and arbitrary object reads are further limited by typed deserialization, but an attacker can still influence the request target on that host and induce authenticated backend requests.

CVE-2026-55414First seen Jun 20, 2026

OpenBao's Transit secrets engine contains an input-validation flaw in key creation handling. An authenticated caller can submit a create-key request to `transit/keys/*` that combines an asymmetric key type such as `rsa-*`, `ecdsa-*`, or `ed25519` with `derived: true`. According to the advisory, this invalid (`type`, `derived`) combination is not properly rejected by the create-key handler and instead can crash the OpenBao server process. The issue is therefore a remotely triggerable denial-of-service condition caused by insufficient validation of unsupported key-creation parameters.

CVE-2026-55776First seen Jun 20, 2026

CVE-2026-55770 is an LDAP injection vulnerability in OpenBao's shared ldaputil library. According to the provided advisory, the issue is caused by using RFC 4514 distinguished-name escaping instead of RFC 4515 LDAP filter escaping when constructing LDAP bind/search values from user-controlled usernames. The vulnerable logic is in the LDAP authentication flow, specifically in filter construction paths in sdk/helper/ldaputil/client.go, including the UPNDomain and UserDN/UserAttr paths in GetUserDN(). Because attacker-controlled username input is incorporated into LDAP filter context with incorrect escaping, a crafted username can inject LDAP filter syntax and alter directory lookup behavior.

CVE-2026-55770First seen Jun 20, 2026

OpenBao contains a cross-namespace authorization flaw in the canonical sys/leases revoke/renew endpoints. According to the provided advisory, this is an incomplete fix related to CVE-2026-45808. An authenticated user with access to sys/leases/revoke/:lease_id in one namespace can operate on leases belonging to other namespaces if the lease identifier is known, indicating improper authorization enforcement on lease operations across namespace boundaries. The issue affects multi-tenant isolation by allowing canonical lease management endpoints to bypass intended ACL restrictions.

CVE-2026-55774First seen Jun 20, 2026

CVE-2026-55866 affects SpiceDB permission evaluation for checks involving relations with caveats. Under specific concurrent workloads, SpiceDB can incorrectly treat a conditional authorization result as unconditional. According to the advisory, CheckPermission and CheckBulkPermissions may return HAS_PERMISSION for requests that should resolve to CONDITIONAL_PERMISSION, and may also return HAS_PERMISSION where the supplied context should instead produce NO_PERMISSION. The issue is associated with concurrent execution and the dispatch result cache behavior, causing incorrect authorization decisions for caveated relations.

CVE-2026-55866First seen Jun 20, 2026

CVE-2026-55795 is a coupon code brute-force vulnerability in Craft Commerce. According to the provided advisory, the issue is caused by a rate-limit bypass in CartController: rate limiting for coupon submission is only enforced when the 'number' POST/GET parameter is explicitly supplied. As a result, requests to the cart update action can avoid the intended throttling logic by omitting that parameter while still submitting coupon guesses. This allows automated enumeration of valid coupon codes against a session-based cart.

CVE-2026-55795First seen Jun 20, 2026

CVE-2026-55650 is a stored cross-site scripting vulnerability in the Text Widget of Outerbase Studio. According to the provided advisory, the issue is caused by unsafe HTML rendering through dangerouslySetInnerHTML, allowing attacker-controlled or untrusted HTML content stored in the widget to be rendered and executed in the browser context. The vulnerable behavior affects versions up to 0.10.2, and the fix removed the unsafe HTML rendering path.

CVE-2026-55650First seen Jun 20, 2026

CVE-2026-55091 is a prototype pollution vulnerability in the npm package flat-to-nested. According to the provided advisory context, the issue is in the convert() functionality, which unsafely uses attacker-controlled id and parent values as object keys. Because these keys are inserted into ordinary JavaScript objects without blocking special property names, an attacker can supply values such as '__proto__' and thereby modify Object.prototype. The vulnerable behavior stems from using user-influenced identifiers as keys in temporary lookup structures, enabling pollution of the global object prototype chain.

CVE-2026-55091First seen Jun 20, 2026

CVE-2026-55374 affects Packagist/jleehr/canto-saas-api. The library constructs authenticated API request URLs using path variable values that are inserted without proper URL encoding. Because path segments are not encoded before being incorporated into the request path, an attacker who can control a path variable can manipulate the resulting URL path and cause the client to send an authenticated request to a different endpoint on the same Canto instance than the developer intended. The issue is remediated in version 3.0.0 and later by encoding path segments with rawurlencode() before inserting them into the request URL.

CVE-2026-55374First seen Jun 20, 2026

canto-saas-api improperly exposes OAuth secrets during Canto OAuth flows by placing sensitive values in URL query strings and including them in exception messages. According to the provided advisory, affected requests may leak the Canto app_secret, refresh_token, or authorization code into web server logs, proxy logs, APM/tracing systems, and application error logs. The issue was remediated in version 3.0.0 by moving OAuth credentials from URL query parameters into the form-encoded POST body and sanitizing exception messages to mask sensitive values.

CVE-2026-55375First seen Jun 20, 2026

CVE-2026-55847 is a stored cross-site scripting vulnerability in Allure Report's allure-generator component. According to the provided advisory, the issue is caused by unescaped HTML in the ansi.js Handlebars helper when rendering statusMessage and statusTrace values from test result files. Because the helper returns HTML-safe output while attacker-controlled content is not properly escaped first, malicious markup or script embedded in imported test result data can be persisted into the generated report and executed in the browser when the report is viewed.

CVE-2026-55847First seen Jun 20, 2026

CVE-2026-55690 is a stored cross-site scripting vulnerability in the StarCitizenWiki EmbedVideo extension. According to the provided advisory, the issue is caused by unsanitized service names being reflected into HTML error messages. An attacker able to edit wiki content can supply a crafted service name via EmbedVideo parser functionality such as {{#ev:}} or {{#evl:}}, causing attacker-controlled HTML/JavaScript to be stored in page content and rendered to subsequent visitors in the wiki origin.

CVE-2026-55690First seen Jun 20, 2026

CVE-2026-55691 is a stored cross-site scripting vulnerability in the StarCitizenWiki Embed Video extension. According to the provided advisory, the issue is caused by an unsanitized user-supplied class value being inserted into generated HTML. This allows attacker-controlled markup to be persisted and later rendered in application pages, where it can execute in victims' browsers when the malicious content is viewed.

CVE-2026-55691First seen Jun 20, 2026

CVE-2026-47256 is a path traversal and query-string injection vulnerability in the OpenTelemetry Collector Contrib Sentry exporter package, github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter. According to the provided advisory, attacker-controlled service.name values received from remote OTLP senders are used to derive Sentry project slug values without sufficient validation before constructing Sentry API URL paths. This allows a remote sender to manipulate the resulting Sentry API request path and query string, causing the collector to access arbitrary Sentry API endpoints using the bearer token configured by the operator for the exporter. The core flaw is improper neutralization of path elements in externally influenced URL construction, enabling traversal away from the intended project-specific API path and injection of attacker-chosen request components.

CVE-2026-47256First seen Jun 19, 2026

CVE-2026-55226 is an authorization flaw in Strimzi's Entity Operator RBAC configuration. When only one sub-operator is deployed—either the Topic Operator or the User Operator—the Entity Operator ServiceAccount is still granted permissions broader than required for the deployed component. As a result, the ServiceAccount retains access to Kubernetes resources associated with the non-deployed operator, violating least-privilege expectations. According to the advisory, this can expose access to KafkaUser custom resources and Secrets when the User Operator is not deployed, and to KafkaTopic custom resources when the Topic Operator is not deployed.

CVE-2026-55226First seen Jun 19, 2026

CVE-2026-55701 affects the githubreceiver component in opentelemetry-collector-contrib. In affected versions, the receiver silently ignores operator-configured required_headers authentication, so requests to the GitHub webhook endpoint may be accepted even when the deployment is configured to require specific headers for authentication. According to the advisory, the flaw is due to missing RequiredHeaders enforcement in handleReq(). As a result, webhook requests can be processed without the intended header-based access control being validated.

CVE-2026-55701First seen Jun 19, 2026

CVE-2026-55617 is an insufficient session expiration flaw in Hydro's session recreation logic. According to the provided advisory, when Hydro recreates a session during logout or session renewal, the previously valid server-side session associated with the old sid cookie is not properly invalidated before a new session is created. As a result, an old sid cookie that should no longer be usable can remain valid and continue to authenticate requests. The issue is effectively caused by failure to delete the old server-side session token during session recreation, allowing stale session identifiers to be replayed after logout or renewal.

CVE-2026-55617First seen Jun 19, 2026

CVE-2026-54711 is an information exposure vulnerability in PGHoard where database connection information, including the username and password sourced from .pgpass, is written to debug-level logs. The issue results in sensitive credential material being recorded in log output during normal debugging or verbose operation, creating a secondary disclosure channel for secrets that should not be logged.

CVE-2026-54711First seen Jun 19, 2026

CVE-2026-55887 is an argument injection vulnerability in Docker MCP Gateway affecting the handling of OCI image label YAML metadata. According to the provided advisory, attacker-controlled image metadata from a referenced OCI image can inject arbitrary `docker run` arguments during container creation. The vulnerable behavior stems from the OCI image-label parser accepting runtime-controlling fields from image labels instead of limiting parsing to descriptive metadata only. This allows untrusted image-supplied YAML to influence container runtime invocation parameters.

CVE-2026-55887First seen Jun 19, 2026

Signal K Server contains a server-side request forgery vulnerability in administrative remote connection management endpoints. The vulnerable functionality allows attacker-controlled outbound HTTP/HTTPS requests by supplying remote host, port, TLS, and request path parameters. According to the provided advisory, these endpoints may be reachable without authentication on default installations. The issue can also permit attacker control over TLS verification behavior, further weakening the security of outbound requests.

CVE-2026-55591First seen Jun 19, 2026

CVE-2026-54683 is an authorization flaw in NL Portal Backend Libraries documenten-api caused by an incomplete fix for CVE-2026-49463. In affected versions, any authenticated user could retrieve document contents through the REST endpoint GET /api/documentapi/*/document/*/content or through the GraphQL getDocumentContent query without a per-document authorization check. As a result, access control was enforced only at the authentication level, not at the individual document level, allowing users to access documents outside their permitted scope if they knew or could obtain a target document identifier. The issue was fully resolved in version 3.0.3.

CVE-2026-54683First seen Jun 19, 2026

CVE-2026-55636 affects Capsule and is described as an incomplete fix for CVE-2026-30963. In vulnerable versions introduced in 0.13.0, a singular/plural typo in the validating webhook rules uses 'namespace/finalize' instead of the correct Kubernetes subresource path 'namespaces/finalize'. As a result, PUT requests targeting /api/v1/namespaces/<ns>/finalize are not matched by the intended webhook protection. This leaves the namespace finalize subresource effectively unprotected by the validating webhook and allows an attacker to bypass Capsule's tenant-label enforcement on namespace finalization operations.

CVE-2026-55636First seen Jun 18, 2026

Omni contains a same-host path traversal vulnerability in the CreateSchematic API. According to the advisory, the issue is caused by unsanitized talos_version input, which allows an authenticated Operator to manipulate the path used in HTTP GET requests sent to the configured image-factory server. By traversing URL paths on that host, an attacker can cause the application to request unintended endpoints and receive reflected error content from those endpoints. The issue is constrained to the configured image-factory host rather than arbitrary external hosts, but still enables unintended access to paths and resources on that server.

CVE-2026-45723First seen Jun 6, 2026