Application-Security

DBeaver contains multiple security vulnerabilities that may allow a local or remote attacker to achieve arbitrary code execution or cause a denial-of-service condition.

Yamaha VOCALOID6 Editor is vulnerable to XML External Entity (XXE) injection via specially crafted project files, enabling unauthorized sensitive information disclosure or denial-of-service.

Cisco AI Defense alerts indicate potential iterative prompt injection or unauthorized data exfiltration attempts against generative AI applications, characterized by bursts of high-risk guardrail violations.

IBM Business Process Manager contains multiple cross-site scripting vulnerabilities that allow an unauthenticated remote attacker to inject malicious scripts into user sessions.

A vulnerability in Ghost versions 5.2.0 through 6.61.9 allows unauthenticated remote attackers to manipulate Stripe Checkout flows to modify member records and inject malicious content into newsletters.

A vulnerability in quarkus-websockets-next allows a remote attacker to cause a Denial of Service via heap exhaustion by streaming WebSocket messages faster than the application can process them.

An arbitrary file upload vulnerability in the Gravity Forms WordPress plugin (<= 3.0.2) allows unauthenticated attackers to write arbitrary files to the temporary upload directory, potentially leading to remote code execution or stored XSS.

GitLab is affected by multiple vulnerabilities that allow remote code execution, denial of service, data manipulation, and security control bypass.

A critical unauthenticated SQL injection vulnerability (CVE-2026-76904) in the GeoTools library allows remote attackers to execute arbitrary SQL via the jsonArrayContains filter function.

SiYuan versions prior to 3.7.4 contain an authentication bypass vulnerability allowing unauthenticated remote attackers to retrieve decrypted content from encrypted notebooks.

An algorithm developer in the vantage6 system can modify another developer's algorithm metadata or Docker image tag, even when that algorithm is pending review, allowing an attacker with low privileges to replace an approved algorithm with an unapproved or malicious image.

An authenticated n8n user with 'use-only editor access' can exploit CVE-2026-59209 in shared workflows when `N8N_EXPRESSION_ENGINE=vm` is enabled, allowing them to read sensitive HTTP Header Auth credentials from the `$request.headers` object within a paginated HTTP Request node's expression and exfiltrate them, bypassing credential domain restrictions.

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the Git node's clone operation in n8n versions prior to 1.123.64, 2.29.8, and 2.30.1. This vulnerability allows authenticated users to bypass path restrictions by swapping a validated directory for a symlink, enabling them to plant a crafted repository in the community node directory. Upon the next restart, n8n loads this as a custom node, leading to arbitrary JavaScript execution on the server, affecting both self-hosted and cloud instances.

A remote code execution vulnerability, CVE-2026-40501, exists in Cherry Studio versions 1.2.2 through 1.9.12 due to improper Electron BrowserWindow configuration, allowing remote attackers to execute arbitrary code by injecting malicious JavaScript through controlled search provider content, thereby gaining full Node.js privileges and accessing system resources.

A vulnerability in OpenClaw allows an attacker with `operator.write` privileges to bypass intended administrative command scope gates by delivering a scoped Gateway `chat.send` request through an inherited external route, leading to unauthorized execution of critical administrative commands.

Detects when an Okta application is modified or deleted, potentially indicating unauthorized changes or removal of critical applications.