Nango CVE-2026-92804

Path traversal in decap-server's local proxy containment guard allows an unauthenticated attacker to read, write, or del

Unauthenticated access to the AgentOS HTTP server shipped in the npm `praisonai` package (versions 1.6.0 through 1.7.1)

Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account

An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependenc

Trigger.dev before 4.6.0 allows an authenticated low-privilege user to bind an arbitrary GitHub App installation to thei

Twenty CRM before 2.35.0 fails to enforce field- and row-level permission checks inside the groupBy-with-records GraphQL

Unauthenticated information disclosure in Rallly before 4.15.0 allows remote attackers who possess a poll's urlId to ret

SQL injection in the ORDER BY direction handling of MikroORM (a TypeScript ORM for Node.js) lets authenticated remote at

Cache-key pollution in the @orpc/server CORS plugin (oRPC versions prior to 1.14.8) allows remote, unauthenticated clien

Guest-level users on kan through 0.6.0 can create boards they are not entitled to create by invoking the GitHub project

Path traversal in the Redocly CLI `split` command (@redocly/cli prior to 2.33.2, and the 1.x line prior to 1.34.17) lets