Latest Vulnerabilities

CVE ID :CVE-2026-74791 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again. Severity: 9.2 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-74796 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree. Severity: 7.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-74790 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-74792 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path (ParseArrayInitializer → ParseExpression → ParseArrayInitializer) that is not covered by the ExpressionDepthLimit counter added in the fix for GHSA-wgh7-7m3c-fx25. An attacker who can supply untrusted input to Template.Parse can trigger an uncatchable StackOverflowException that immediately terminates the process, even with the default ExpressionDepthLimit enabled. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-74794 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-74795 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (the ExpressionDepthLimit property in ParserOptions defaults to null/disabled), so an attacker who controls template input can supply a deeply nested template (e.g., thousands of nested parentheses or blocks) that exhausts thread stack space and raises a StackOverflowException. Because a StackOverflowException cannot be caught in .NET, this causes immediate, unrecoverable termination of the hosting process, resulting in a denial of service. Applications that process untrusted or user-supplied templates can be exploited remotely without authentication. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-74797 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process. Severity: 3.1 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-74785 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attackers who can supply templates can cause out-of-memory exceptions or CPU exhaustion, typically terminating the entire host process. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-74786 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in which the LimitToString safety limit (default 1MB) can be bypassed because ObjectToString resets the per-call length counter (_currentToStringLength) on every top-level call and StringBuilderOutput enforces no cumulative output-size limit. An attacker who can supply a template can render a near-limit string repeatedly in a loop, allocating approximately 1GB of memory and causing an out-of-memory condition that crashes the host application. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-74787 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the hosting .NET process. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-74788 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template functions, which perform no validation on the width parameter before delegating to .NET’s String.PadLeft/PadRight. When an application exposes Scriban to untrusted template input, an attacker can supply an arbitrarily large width value (e.g., 500,000,000) to trigger ~1GB memory allocations in a single call, resulting in OutOfMemoryException and denial of service. The TemplateContext.LimitToString limit does not prevent this because it is only enforced after the string has been fully allocated. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-74789 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} — or a memory-amplification expression such as {{ ‘A’ * 200000000 }} — can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service. Applications that render attacker-controlled templates and rely on LoopLimit for safe execution are affected. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-74783 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-74784 Published : Aug. 16, 2026, 2:16 p.m. | 18 minutes ago Description :Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLimit or LimitToString constraints. Attackers can supply a large index parameter to trigger OutOfMemoryException and crash the host process in under a second. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-73057 Published : Aug. 16, 2026, 2:16 p.m. | 19 minutes ago Description :stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-73056 Published : Aug. 16, 2026, 2:16 p.m. | 19 minutes ago Description :SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is protected by the application’s CAPTCHA/lockout mechanism (NeedCaptcha/WrongAuthCount). As a result, an unauthenticated remote attacker can perform unlimited automated guesses of the API token, particularly when a short or weak custom token has been configured, and upon success gains full RoleAdministrator access enabling arbitrary file operations and SQL queries. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-73058 Published : Aug. 16, 2026, 2:16 p.m. | 19 minutes ago Description :stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-73059 Published : Aug. 16, 2026, 2:16 p.m. | 19 minutes ago Description :stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-73060 Published : Aug. 16, 2026, 2:16 p.m. | 19 minutes ago Description :Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-73061 Published : Aug. 16, 2026, 2:16 p.m. | 19 minutes ago Description :Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-73062 Published : Aug. 16, 2026, 2:16 p.m. | 19 minutes ago Description :Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-19349 Published : Aug. 16, 2026, 2:16 p.m. | 19 minutes ago Description :Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends. Before redirecting to the identity provider, extractFormInfo() creates the state session with the positional call `getApacheSession( undef, 1, 0, ‘GitHubState’ )`. getApacheSession() takes a session id followed by a named argument hash, so the trailing arguments become that hash, `kind` defaults to SSO, and the state is written to the global session storage as a regular SSO session. Its identifier is handed to the unauthenticated visitor as the state parameter of the redirection URL. Any visitor who reaches the GitHub or LinkedIn endpoint can replay that identifier as a session cookie and obtain a valid SSO session without authenticating. The session holds neither _user nor authenticationLevel, which the shipped bootstrap configuration accepts because it grants virtual hosts a “default => accept” access rule; deployments whose rules test the user or require an authentication level are less exposed. Only configurations with the GitHub or LinkedIn authentication module enabled are affected. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-72887 Published : Aug. 16, 2026, 2:16 p.m. | 19 minutes ago Description :Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token. Passing a callback to the constructor selects OAuth 1.0a. get_request_token then revokes that choice when the request token response omits oauth_callback_confirmed, with no exception, no warning and no option to require 1.0a. The access token request is built from the OAuth 1.0 message class, which has no verifier parameter, so oauth_verifier is dropped from the request even when get_access_token was passed one. oauth_verifier is the binding that OAuth 1.0a added between the authorization step and the token exchange. An application that asked for 1.0a and gets 1.0 is open to OAuth 1.0 session fixation, where an attacker obtains a request token, has the victim authorize it, and then completes the exchange themselves, linking the victim’s provider account to a session the attacker controls. No attacker action sets up the downgrade: a provider that does not confirm the callback is enough. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-72888 Published : Aug. 16, 2026, 2:16 p.m. | 19 minutes ago Description :Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require. smart_require stores results in a process-global hash with no bound and no eviction, and keeps an entry for every class name it is asked about, including names that failed to load, because the return value of the failed eval is stored before the error is checked. The key comes off the wire on the server side: _signature_method_class builds the class name from the signature_method parameter of the incoming message, and verify resolves it before any signature is checked. A remote client chooses both how many entries are created and how long each key is. In a persistent server the hash grows for the life of the worker process until it exhausts memory. Header size limits bound the key length on the Authorization header path, but not on a POST body. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2024-58375 Published : Aug. 16, 2026, 2:16 p.m. | 19 minutes ago Description :OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…