WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responses

Bug reported by 0xBS0D27 was disclosed at November 5, 2026, 2:18 pm   |   Improper Access Control - Generic

A password protection bypass was identified in a REST API wrapper for recurring events. The wrapper endpoint exposed RSVP attendee roster data without verifying password authentication, while the core API correctly enforced password gates. Unauthenticated requests could retrieve attendee names, user IDs, profile information, and comment details for password-protected events. The vulnerability was caused by the wrapper route using a permission callback that always returned true without checking password requirements.

wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_roles

Bug reported by 0xBS0D27 was disclosed at November 5, 2026, 2:18 pm   |   Improper Access Control - Generic

A privilege escalation vulnerability was found in a wordpress.org custom mu-plugin used on locale team sites. The vulnerability allowed authenticated editors to assign the administrator role to users during the account invitation process, despite administrator being explicitly removed from the editable roles list. The role parameter was accepted directly from user input without validation against the permitted roles before the invitation was stored. When the invitation was accepted, the stored role was applied without re-validation, resulting in unauthorized administrator access being granted. The issue affected the invite persistence mechanism which failed to enforce role restrictions that were properly implemented elsewhere in the codebase.

Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to order

Bug reported by 0xBS0D27 was disclosed at November 5, 2026, 2:18 pm   |   Improper Access Control - Generic

A payment binding vulnerability was identified in the Instamojo payment gateway addon for a ticketing system. The gateway failed to verify and bind Instamojo payments to specific ticket orders. Three attack paths were present: a draft order could be marked pending using only a payment token without Instamojo API verification, invalid webhook signatures were accepted and still marked orders as pending instead of rejecting them, and valid webhooks with credit status could complete orders without verifying the payment matched the order amount. The issue was noted as a logic error at the payment boundary that was not present in similar payment gateway implementations within the same codebase.

Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports

Bug reported by 0xBS0D27 was disclosed at November 5, 2026, 1:59 pm   |   Improper Access Control - Generic

A broken authorization check in a WordCamp plugin allowed unauthenticated attackers to export a private CSV file containing organizer personally identifiable information. The vulnerability was caused by an inverted logic operator in the security gate that verified nonce validity and user capabilities, resulting in the protection being bypassed for users without authentication or valid nonces. The exported data included email addresses, physical addresses, messaging handles, usernames, and notes.

CPU-based Denial of Service in translation-finder via O(N²) per-result wildcard mask matching

Bug reported by Robin was disclosed at November 5, 2026, 9:51 am   |   Uncontrolled Resource Consumption

A CPU-based denial of service vulnerability was identified in a translation file discovery library. The vulnerability resulted from inefficient algorithmic complexity in wildcard mask matching operations. When processing directories or archives containing multiple files sharing the same suffix, the discovery function performed on the order of N squared fnmatch operations. This was caused by bucket-scanning logic that was repeated once per discovered result rather than being performed once per mask. The vulnerability affected properties-style and JSON file backends but not Gettext format files. The inefficiency persisted even when discovery produced zero results, making pre-filtering ineffective as a mitigation. Processing 4,000 files took approximately 11 seconds of CPU time, while 8,000 files required around 46 seconds. The vulnerability was exploitable through the library's public discovery interface when integrated into web applications that executed the discovery process synchronously within request handling.

Connector/ODBC: SqlwcsOctetLen sizes UTF-16 with a byte-oriented helper, reading past the caller's buffer and sending client memory to the server

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 12:36 pm   |   Out-of-bounds Read

A buffer over-read vulnerability was identified in a database connector library's wide character string handling function. The function incorrectly sized UTF-16 strings by using a byte-oriented helper that inspected only the low byte of each code unit, causing the cursor to advance past the intended buffer boundary. This resulted in uninitialized memory being read and transmitted to the database server as part of SQL statements. The vulnerability affected the POSIX build and was triggered by ordinary characters from various languages. The memory disclosure was limited to 12-16 bytes per statement but occurred repeatedly during normal operation with affected character sets.

r2dbc-mariadb: server message accepted with no command in flight desynchronises the connection and serves one user's rows to another

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 12:35 pm   |   Information Disclosure

A vulnerability was discovered in an open-source database connector library that caused desynchronization of request and response messages on database connections. When a packet arrived from the server while no command was outstanding, the driver buffered it and served it to the next unrelated statement without validating any correlation between requests and responses. This allowed an attacker positioned on the network path to inject a single malicious packet that permanently shifted all subsequent responses, causing one user's data to be returned to another user and causing write operation results to be misreported. The vulnerability persisted for the lifetime of the affected connection and could not be detected by the application layer. The issue was confirmed in version 1.4.1 and the development branch, affecting the default configuration of the driver. The vulnerability required the attacker to be able to inject bytes into the client-server communication stream.

Connector/ODBC injects unquoted column names into positioned DELETE and UPDATE via MADB_DynStrGetWhere

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 12:35 pm   |   SQL Injection

A SQL injection vulnerability was discovered in the ODBC connector where unquoted column names were injected into positioned DELETE and UPDATE statements. The column values were properly escaped, but the column names were appended directly without any quoting or escaping. This allowed an attacker who could control a column or table name to execute arbitrary SQL on the application's connection with its privileges. When an application requested deletion of a single row, all rows in the table could be deleted instead. The vulnerability was present in versions 3.2.6 and 3.2.10, and affected both DELETE and UPDATE operations through positioned cursor operations.

Connector/ODBC SQLGetDescRec treats descriptor handle as statement handle, heap OOB write on every call

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 12:35 pm   |   Type Confusion

A heap buffer overflow vulnerability was discovered in the ODBC driver's SQLGetDescRec and SQLGetDescRecW functions. These functions incorrectly used a statement handle macro on a descriptor handle, causing writes 13 bytes past the end of a 720-byte descriptor allocation. On standard builds, this memory corruption was sufficient to trigger heap consistency checks and crash the process. Additionally, a portion of the buffer was filled with server-supplied version information, which allowed a network attacker to influence the offset of a secondary write operation. The vulnerability affected the current master branch of the driver and was confirmed to cause crashes and memory corruption.

Stack buffer overflow in 9 of 10 Connector/ODBC catalog functions via unbounded name

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 12:34 pm   |   Stack Overflow

A stack buffer overflow vulnerability was discovered in nine of ten catalog functions in a database connector driver. The affected functions failed to validate the length of application-supplied identifiers before escaping them into a fixed-size stack buffer. Identifiers longer than 256 bytes could overflow the 513-byte buffer with attacker-controlled data. The overflow occurred during query string assembly before communication with the server, requiring no database privileges or server cooperation. One catalog function properly validated identifier length and rejected oversized input, while the other nine did not perform this validation consistently.

Connector/C++ ignores allowMultiQueries and injects savepoint names into SQL

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 11:40 am   |   SQL Injection

Connector/C++ contained two SQL injection vulnerabilities in statement building. The driver ignored the allowMultiQueries configuration setting and passed a hardcoded flag to the database connection function, which caused stacked statements to be accepted on every connection regardless of the configuration. Additionally, savepoint names were concatenated directly into SQL statements without quoting or validation, allowing arbitrary SQL injection through the setSavepoint and releaseSavepoint methods. These defects were demonstrated to result in arbitrary DDL execution on a running database server.

Connector/C++ aborts client process on server session-tracking packet via std:toi

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 11:40 am   |   Uncontrolled Resource Consumption

A flaw was discovered in the Connector/C++ driver where the QueryProtocol::handleStateChange function improperly processed session-tracking packets from a server. The code attempted to parse a session variable name as an integer using std:toi, which caused an std::invalid_argument exception to be thrown. This exception type was not caught by the driver's error handling or by standard application exception handlers, resulting in an unhandled exception that terminated the client process. The vulnerability was triggered whenever a server sent a session-state-changed status flag with a SESSION_TRACK_SYSTEM_VARIABLES entry for auto_increment_increment. The root cause was that the code retrieved only the variable name from the packet instead of the corresponding value before attempting the conversion.

Connector/C++ string escaper re-escapes its own output, enabling SQL injection

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 11:39 am   |   SQL Injection

A string escaping vulnerability was discovered in the database connector's utility function that processed identifiers and literals for information schema queries. The escaper's inner loop advanced its search cursor incorrectly, causing it to re-escape characters it had already inserted. This resulted in runs of escape characters with odd lengths that left live escape characters to consume closing quotes. The vulnerability affected multiple metadata methods and identifier-quoting APIs, allowing SQL injection through untrusted table, schema, or column names. An independent defect in three sibling helper functions caused inconsistent escaping behavior, with two functions hardcoding an incorrect flag that disabled backslash escaping against default server configurations. Both defects were confirmed through testing against 336 payload shapes, with the escaping logic flaw alone closing all injection vectors. The vulnerability enabled unauthorized data access across database boundaries and boolean-based information extraction.

`Vary` cache-key conflation of absent and empty request fields

Bug reported by was disclosed at November 3, 2026, 6:51 pm   |  

A cache-key generation vulnerability was identified in Django's cache middleware that conflated absent and empty request fields nominated by Vary headers. When a request header was absent versus present with an empty value, the same cache key was generated, causing responses intended for one request state to be returned for the other. This behavior violated HTTP caching standards that require absent nominated fields to match only other requests where that field is also absent. The vulnerability allowed cached private responses to be disclosed to requests in different states, as demonstrated through a proof of concept that showed a private response cached for a request with an empty header being returned to a request without that header.

wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list

Bug reported by Jakub Kozub was disclosed at October 30, 2026, 9:41 pm   |   Open Redirect

A vulnerability was discovered in the open redirect feature of a WordPress theme that serves a subdirectory site. The vulnerability was caused by incorrect use of a string replacement function where the fourth argument, intended to limit replacements to one occurrence, was actually interpreted as an output parameter rather than a limit. This caused all instances of the path prefix to be removed instead of just the leading one. When a specially crafted path containing the prefix twice was requested, the remaining portion could be concatenated with a base URL in a way that altered the authority component, redirecting users to an attacker-controlled destination. The redirect used an unsafe API that performed no destination validation. The vulnerability allowed unauthenticated attackers to bypass the site's SSO redirect allow-list by crafting URLs that appeared to point to the legitimate domain but redirected elsewhere. The impact included silent redirection of users to attacker-controlled hosts with permanent browser caching and legitimate referrer information, creating an effective phishing vector.

launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API

Bug reported by Sahraoui Aymen was disclosed at October 30, 2026, 1:40 pm   |   Improper Authentication - Generic

A custom OAuth2 authorization server was found to issue victim-bound API credentials to unverified attacker-controlled redirect URIs. The authorization server accepted client registrations with self-chosen redirect URIs without performing ownership verification, ownership approval, or URI structure validation. During authorization, the server treated these unverified URIs as trusted redirect destinations.

The deprecated implicit grant type was still enabled, which delivered access tokens directly to registered redirects in URL fragments without requiring client authentication or an authorization code exchange. Additionally, the authorization server accepted and honored dangerous redirect URI patterns including cleartext HTTP loopback addresses, custom application schemes, and wildcard hosts and paths.

A victim-bound access token delivered to an attacker-controlled redirect was demonstrated to have full impact across confidentiality, integrity, and availability. The token was used to read the victim's project lists, modify project names server-side with confirmed persistence, and permanently delete victim projects. All operations returned successful HTTP status codes and were verified to have persisted on the server.

Cross-account webhook takeover: PUT and DELETE on //webhooks/.json reach another account's webhook

Bug reported by deivizzzz was disclosed at October 30, 2026, 11:08 am   |   Improper Authentication - Generic

A cross-account webhook takeover vulnerability was identified in Basecamp's webhook API endpoints. The PUT and DELETE operations on webhook resources were authorizing based on project visibility rather than account membership. This allowed an attacker from one account to modify and delete webhooks belonging to another account when the victim's project was configured with all-access permissions. The vulnerability enabled redirection of webhooks to attacker-controlled servers, allowing interception of sensitive project communications and data.

A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option

Bug reported by deivizzzz was disclosed at October 30, 2026, 11:07 am   |   Improper Access Control - Generic

A third-party OAuth token was able to mint a full web session through an API endpoint, allowing an integration to obtain unauthorized session access and modify account settings. The vulnerability has been patched to only accept authorized session tokens.

Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.

Bug reported by 0xsumit was disclosed at October 30, 2026, 5:08 am   |   Path Traversal

A translation management application contained incomplete VCS metadata exclusion in its ZIP download feature. The exclusion mechanism only covered Git and Mercurial metadata directories but failed to exclude Subversion and Bazaar metadata directories. This gap allowed Subversion and Bazaar metadata files, including working-copy databases and credential cache entries, to be included in downloaded archives when such directories were present in component trees. The issue represented a completeness failure in a security hardening mechanism introduced in a prior security fix, affecting multiple code paths including path validation, symlink resolution, backup operations, and component discovery.

wlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks.

Bug reported by 0xsumit was disclosed at October 30, 2026, 5:07 am   |   Information Exposure Through an Error Message

The wlc command-line client did not properly handle filesystem errors, which caused two distinct issues. First, when project-wide downloads failed partway through, already-written archives were left on disk with no report of which components succeeded or failed, making it impossible to distinguish complete results from partial ones. Second, any filesystem error such as permission denied, file exists, or file not found resulted in an uncaught exception that printed a full Python traceback to stderr instead of a user-friendly error message. The traceback exposed local absolute paths and internal package information. These issues affected both download and upload operations and were present in release 2.2.0 and the main development branch.

Translation discovery crashes on crafted filenames (regex substitution injection)

Bug reported by 0xsumit was disclosed at October 30, 2026, 5:07 am   |   Use of Externally-Controlled Format String

A translation discovery package was vulnerable to a regular expression injection attack through crafted filenames. When processing repository files, the package interpolated user-controlled filename components into regex replacement strings without proper escaping. Filenames containing backslash sequences like backslash-g-angle-bracket-99-angle-bracket were interpreted as regex backreferences, causing the regex engine to raise errors. These uncaught exceptions terminated the entire discovery process for a repository. An attacker with commit access could exploit this to cause a denial of service by committing a single file with a specially crafted name. The vulnerability was fixed by passing wildcard replacements through a callback function instead of string interpolation.

wlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks.

Bug reported by 0xsumit was disclosed at October 30, 2026, 5:07 am   |   Information Exposure Through an Error Message

The wlc command-line client did not properly handle filesystem errors, which caused two distinct issues. First, when project-wide downloads failed partway through, already-written archives were left on disk with no report of which components succeeded or failed, making it impossible to distinguish complete results from partial ones. Second, any filesystem error such as permission denied, file exists, or file not found resulted in an uncaught exception that printed a full Python traceback to stderr instead of a user-friendly error message. The traceback exposed local absolute paths and internal package information. These issues affected both download and upload operations and were present in release 2.2.0 and the main development branch.

Translation discovery crashes on crafted filenames (regex substitution injection)

Bug reported by 0xsumit was disclosed at October 30, 2026, 5:07 am   |   Use of Externally-Controlled Format String

A translation discovery package was vulnerable to a regular expression injection attack through crafted filenames. When processing repository files, the package interpolated user-controlled filename components into regex replacement strings without proper escaping. Filenames containing backslash sequences like backslash-g-angle-bracket-99-angle-bracket were interpreted as regex backreferences, causing the regex engine to raise errors. These uncaught exceptions terminated the entire discovery process for a repository. An attacker with commit access could exploit this to cause a denial of service by committing a single file with a specially crafted name. The vulnerability was fixed by passing wildcard replacements through a callback function instead of string interpolation.

Revoked deployment collaborator regains access to private comments after active collaborator interaction

Bug reported by Domingos Toko Muanda was disclosed at October 29, 2026, 8:25 am   |   Access Control Check Implemented After Asset is Accessed

A revoked deployment collaborator was able to regain access to private collaboration data after an active collaborator interacted with the deployment toolbar. After a collaborator's authorization was revoked and their token became invalid, a subsequent interaction by an active collaborator caused the revoked token to become authorized again. This allowed the revoked user to access the synchronization endpoint and retrieve private deployment collaboration data, including comment threads and messages, without being re-invited or granted new authorization.

Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce

Bug reported by deivizzzz was disclosed at October 28, 2026, 4:58 am   |   Cross-site Scripting (XSS) - Generic

A cross-account cross-site scripting vulnerability was discovered in an embed display endpoint that rendered attacker-supplied HTML verbatim on the application origin without proper authentication checks. The vulnerability could be exploited by crafting a malicious embed with injected HTML and JavaScript that would execute with the victim's privileges when the embed was accessed. The vulnerability was chained with a content security policy bypass where a legitimate JavaScript library from an allowlisted CDN would apply the victim's CSP nonce to injected scripts, allowing arbitrary code execution. This permitted unauthorized access to CSRF tokens, private profile data, and the ability to modify victim account information without authorization.

Launchpad file read leaks production keys

Bug reported by was disclosed at October 28, 2026, 4:53 am   |   Path Traversal

A file-read vulnerability in a platform exposed production storage credentials. The vulnerable processing path was fixed, exposed credentials were rotated, and the old key was deleted.

Launchpad file read leaks production keys

Bug reported by Abdelmounaim Moulahcene was disclosed at October 28, 2026, 4:53 am   |   Path Traversal

A file-read vulnerability in a platform exposed production storage credentials. The vulnerable processing path was fixed, exposed credentials were rotated, and the old key was deleted.

FederationController::remoteWopiToken() returns full Wopi entity without token type validation

Bug reported by Ibrahim el zein was disclosed at October 27, 2026, 11:33 am   |   Improper Access Control - Generic

SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards

Bug reported by alex-elttam was disclosed at October 27, 2026, 11:26 am   |   Server-Side Request Forgery (SSRF)

Tables application does not respect sharing limitations set by admin

Bug reported by Samin Zavarkesh was disclosed at October 27, 2026, 11:22 am   |   Improper Access Control - Generic

Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API

Bug reported by _dha was disclosed at October 27, 2026, 11:19 am   |   Information Disclosure

Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone

Bug reported by _dha was disclosed at October 27, 2026, 11:17 am   |   Improper Access Control - Generic

Unauthorised access with hidden public link creation when sharing to a Team External Member

Bug reported by was disclosed at October 27, 2026, 11:10 am   |   Privilege Escalation

A vulnerability was discovered in the sharing functionality where unauthorized access could be gained through the creation of hidden public links when sharing content to a team external member.

Files Confidential tagging can be bypassed with # in filename

Bug reported by XavLimSG was disclosed at October 27, 2026, 11:00 am   |   Improper Access Control - Generic

Public shares remain accessible via alternate endpoints after owner account is disabled

Bug reported by hamza was disclosed at October 27, 2026, 10:50 am   |   Improper Access Control - Generic

Unauthenticated Persistent Denial-of-Service via Federated Share Injection

Bug reported by was disclosed at October 27, 2026, 10:43 am   |   Uncontrolled Resource Consumption

No password confirmation required when using apptoken on sensitive endpoint

Bug reported by Nicholas Carlini was disclosed at October 27, 2026, 10:40 am   |   Improper Privilege Management

Permission Model filesystem over-grant via wildcard radix lookup

Bug reported by Malik was disclosed at October 27, 2026, 7:06 am   |   Improper Access Control - Generic

A flaw was discovered in Node.js Permission Model filesystem enforcement that allowed access to be granted to paths not matching wildcard read or write rules. When a requested path was shorter than the prefix of a wildcard grant, the radix tree lookup would stop comparing early and incorrectly treat the path as a match. This issue affected wildcard grants positioned directly under the root of the permission tree. This vulnerability impacted Node.js version 26.x.

CVE-2026-115529: Schannel TLS auto client session resumption

Bug reported by Johnny Kao was disclosed at October 26, 2026, 7:54 am   |   Improper Authentication - Generic

CVE-2026-111954: upload reader failed redirect UAF

Bug reported by 1rhino2 was disclosed at October 26, 2026, 7:54 am   |   Use After Free

CVE-2026-111953: GnuTLS SecTrust OCSP staple bypass

Bug reported by Sujit Jaunjal was disclosed at October 26, 2026, 7:54 am   |   Improper Certificate Validation

CVE-2026-111950: TLS session cache diff scheme reuse

Bug reported by was disclosed at October 26, 2026, 7:54 am   |   Incorrect Comparison

CVE-2026-111484: OpenSSL with SecTrust accepts bad OCSP staples

Bug reported by Sujit Jaunjal was disclosed at October 26, 2026, 7:53 am   |   Improper Certificate Validation

CVE-2026-111482: libssh2 knownhosts prefix match

Bug reported by Samuel Henrique was disclosed at October 26, 2026, 7:53 am   |   Partial String Comparison

CVE-2026-111481: server-set cookie still aborts cookie jar

Bug reported by Samuel Henrique was disclosed at October 26, 2026, 7:53 am   |   Improper Input Validation

CVE-2026-111480: pause UAF from within callback

Bug reported by Daniel Wade was disclosed at October 26, 2026, 7:53 am   |   Use After Free

CVE-2026-111952: OpenSSL provider use-after-free again

Bug reported by moltenbit was disclosed at October 26, 2026, 7:52 am   |   Use After Free

CVE-2026-111878: OpenSSL provider UAF on TLS shutdown

Bug reported by Van was disclosed at October 26, 2026, 7:25 am   |   Use After Free

A use-after-free vulnerability was identified in the OpenSSL provider implementation when using the multi interface. The vulnerability occurred when a private library context was freed while an SSL context that borrowed it remained queued for shutdown. This happened because the library context was stored only on the easy handle and was freed during cleanup before deferred shutdown operations completed. When shutdown processing continued on the connection queue, freed memory was accessed through SSL read and shutdown operations, potentially corrupting memory in the process.

CVE-2026-111951: curl -OJ truncate without filename

Bug reported by Mattéo was disclosed at October 26, 2026, 7:22 am   |   External Control of File Name or Path

In curl versions 8.23.0, 8.22.0, and master branch, a vulnerability was identified in the tool's handling of Content-Disposition headers with the -OJ flag. When a response contained multiple Content-Disposition headers where the first lacked a filename parameter, the tool would create and truncate an existing file to zero bytes before refusing to overwrite it, contradicting documented behavior. This occurred because the code fell through to file creation with the URL-derived name before the second header containing the actual filename was processed. The file was left empty while curl reported exit code 23 indicating refusal to overwrite. Similar issues were observed with redirect handling and the -i flag for writing response headers.

CVE-2026-115528: wolfSSL TLS connect without cert

Bug reported by Mattéo was disclosed at October 26, 2026, 7:21 am   |   Improper Certificate Validation

A vulnerability was discovered in curl when built with wolfSSL that allowed TLS connections to complete without certificate verification. When using default certificate verification settings, curl accepted anonymous Diffie-Hellman cipher suites that transmitted no server certificate. This caused user credentials and request data to be sent to unauthenticated servers. The issue was caused by insufficient certificate validation checks in the wolfSSL backend code. Connections using OpenSSL or GnuTLS were not affected by this vulnerability.

CVE-2026-111483: GnuTLS accepts non-successful OCSP staples

Bug reported by Mattéo was disclosed at October 26, 2026, 7:21 am   |   Improper Check for Certificate Revocation

A vulnerability was identified in curl version 8.22.0 and 8.23.0 when built with GnuTLS. The --cert-status option failed to properly validate stapled OCSP responses. Instead of checking the response status and certificate status within the response, the code only verified that some stapled OCSP response was received. This allowed a revoked certificate to be accepted if accompanied by a bogus or non-successful OCSP response. The issue was introduced when OCSP signature verification code was removed, and the previous validation checks for response and certificate status were eliminated. The vulnerability was not present in version 8.21.0 and earlier, where the bogus staple was correctly rejected.

Arbitrary `/tmp` read in discourse via `convert_heif!` decoder-confusion (regression of 4bf3bf6786)

Bug reported by Tuan Nguyen was disclosed at October 26, 2026, 3:43 am   |   Information Disclosure

A decoder confusion vulnerability was discovered in image conversion functionality that allowed arbitrary file reads from temporary directories. When HEIF/HEIC files were processed, the conversion function failed to enforce a specific decoder prefix, allowing ImageMagick to dispatch based on file magic bytes instead of extension. Files with PostScript headers were routed through Ghostscript, which executed arbitrary PostScript code under a restricted sandbox. The PostScript was able to read temporary files, enumerate directory contents, and render the results into JPEG images that were stored as normal uploads and served publicly without authentication. This enabled authenticated users to exfiltrate temporary files from other users and system processes, including in-flight upload buffers, email attachments, and conversion intermediates. The vulnerability was introduced when HEIF support was added and represented a regression of previous security fixes that had enforced decoder specification.

Permission Model bypass with fs.realpathSync

Bug reported by Sir bugs was disclosed at October 23, 2026, 5:38 pm   |   Improper Access Control - Generic

A flaw in the Permission Model filesystem enforcement left fs.realpathSync() without required read permission checks. This was an incomplete fix of a previous vulnerability that only covered fs.realpathSync.native(). Code running under permission restrictions with limited filesystem read access was able to use fs.realpathSync() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints

Bug reported by Alex Cantor was disclosed at October 23, 2026, 5:08 pm   |   Improper Certificate Validation

A flaw was discovered in TLS hostname verification that allowed certificates with only DNS Subject Alternative Names to authenticate IP endpoints when clients connected using non-canonical IPv4 address formats. The verification function failed to classify these alternate spellings as IP addresses and instead normalized them to their canonical form, matching them against certificate DNS names. This resulted in certificates containing numeric DNS entries being incorrectly accepted for IP endpoint authentication. The vulnerability affected multiple versions of a popular runtime environment.

TLS certificate hostname bypass when the IP is written fullwidth digits

Bug reported by HASAN FLAYYIH ABDULLAH was disclosed at October 23, 2026, 3:03 pm   |   Improper Certificate Validation

A flaw was discovered in TLS hostname verification that allowed a certificate without a matching IP address to authenticate connections when the host was written using non-ASCII characters. The verification function failed to recognize such hosts as IP addresses and instead matched them against certificate DNS names and Common Name. A certificate issued for one IP endpoint could be accepted for a different IP endpoint. This regression affected specific versions of the runtime.

Keep-alive socket process a response that was written before the request was sent

Bug reported by HASAN FLAYYIH ABDULLAH was disclosed at October 23, 2026, 3:03 pm   |   Time-of-check Time-of-use (TOCTOU) Race Condition

A flaw was discovered in HTTP Agent connection reuse where a client could accept a response that was sent before the request was transmitted. This occurred because the guard that destroys idle keep-alive sockets when unexpected data arrives only ran when the event loop polled for I/O. If an unsolicited response had already reached the socket but was not yet read when the socket was handed to a new request, the guard was removed without detecting the data, causing it to be parsed as the response to the new request. This vulnerability affected multiple versions of a runtime environment.

TLS certificate hostname bypass when the host loosely resolves to an IP address

Bug reported by anagnorisis2peripeteia was disclosed at October 23, 2026, 2:49 pm   |   Improper Certificate Validation

A flaw was discovered in TLS hostname verification that could allow a server certificate to be validated against a different IP address than the one the client connected to. This occurred when a host used a non-canonical IPv4 literal with a leading zero, as the certificate validation normalization followed different rules than the operating system resolver on some platforms. The vulnerability affected multiple versions of Node.js.

dns.resolve truncates names containing NUL char

Bug reported by HASAN FLAYYIH ABDULLAH was disclosed at October 23, 2026, 12:16 pm   |   Improper Access Control - Generic

A patch for CVE-2026-48930 was found to be incomplete. The fix rejected embedded NUL bytes in DNS lookup entry points but failed to apply the same validation to dns.resolve* entry points that interface with c-ares binding. When a NUL character was passed within a hostname to dns.resolve4(), the call did not throw an error and instead truncated the name at the NUL byte before querying the DNS server. This allowed a different hostname to be resolved than the one validated by the application, bypassing hostname validation checks in SSRF allowlists and DNS-rebinding guards. The vulnerability affected all dns.resolve* methods in both callback and promise APIs.

Large-site Quick Edit reparses a Contributor display name into active HTML

Bug reported by mappymappy was disclosed at October 21, 2026, 8:03 pm   |   Cross-site Scripting (XSS) - DOM

A stored cross-site scripting vulnerability was discovered in the Posts list Quick Edit feature on WordPress sites with more than 10,000 users. When an administrator opened a crafted URL and clicked Quick Edit on a pending post authored by a contributor, the contributor's entity-encoded display name was decoded and reparsed as active HTML through jQuery, allowing arbitrary JavaScript execution. This vulnerability was confirmed to enable the creation of unauthorized administrator accounts through automated exploitation.

Cross-room signaling injection enabling unauthorized force-mute

Bug reported by AB was disclosed at October 21, 2026, 6:56 pm   |   Improper Authentication - Generic

A cross-room signaling injection vulnerability was identified in the Talk application that allowed a low-privileged participant to inject moderator-only internal-signaling control messages into a victim's session. The vulnerability exploited the fact that the server checked moderator permissions only against the sender's own room while queuing messages to arbitrary recipient session IDs based on room participant lists. The message delivery mechanism was keyed only by recipient session ID rather than by room, enabling an attacker in one room to send control messages such as force-mute commands to users in other rooms. The vulnerability was reproduced by sending a forceMute control from one room to an active victim in a separate room, which resulted in the client muting the affected user.

Deck app: Invalid tag color is accepted by API and breaks frontend UI

Bug reported by ₜₕₑ Bₒy Wₕₒ Gₒₜ ᵢₙ was disclosed at October 20, 2026, 12:55 pm   |   Business Logic Errors

A vulnerability was discovered in the Deck application's tag creation feature where the color parameter was not validated by the API. Invalid color values were accepted by the server and stored in the database, causing the tags section of affected boards to become non-functional. The tags could no longer be rendered or managed through the user interface, affecting all users with access to the compromised board. This resulted in a persistent denial of service at the feature level until the invalid data was manually removed from the backend.

Ordinary HEY user can make HEY originate authenticated mail from attacker-selected @hey.com addresses

Bug reported by Alnoman Kamil was disclosed at October 20, 2026, 9:35 am   |   Improper Access Control - Generic

A vulnerability was discovered in HEY's email service that allowed ordinary users to send authenticated emails from arbitrary HEY addresses without authorization. An attacker could create a temporary external account claiming any target HEY address using unrelated SMTP credentials, enqueue a message, and then delete the external account before delivery. This caused the message to be delivered through HEY's infrastructure while retaining the claimed identity and valid authentication signatures. The vulnerability was successfully reproduced, with messages displaying spoofed sender information being delivered to recipient inboxes with passing SPF, DKIM, and DMARC validation.