App
Monthly
OS command injection in Topluyo Desktop for Linux before 2026.9.2410 lets an unauthenticated attacker who controls a URL opened in the application execute arbitrary operating-system commands with the victim user's privileges. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (9.6), so exploitation requires the victim to open the crafted link but then crosses from the app into the OS with high confidentiality, integrity, and availability impact. The vendor advisory identifies 2026.9.2410 as the fix; no public exploit is identified at time of analysis, and the supplied priority label is act_now.
Off-origin preview framing in TinaCMS (tinacms <= 3.13.0 and @tinacms/app <= 2.5.13) lets an unauthenticated attacker who convinces a signed-in editor to open a crafted link such as `#/~//attacker.example/p` make the admin load and trust an attacker-controlled iframe, which is then accepted as the legitimate preview over the admin↔preview postMessage channel. Because the admin executes any GraphQL operation coming from that frame using the editor's own token, the attacker gains the editor's content API read and write access, exposing or modifying protected content. Exploitation needs only one click by an authenticated editor against a default configuration; no public exploit code was identified at time of analysis, and vendor-released patches are available in tinacms 3.14.0 and @tinacms/app 2.5.14.
Error messages returned by the Exchange RPC in Octo STS 0.11.1 and earlier disclose the contents of trust policies to callers whose OIDC token does not satisfy them. Remote, unauthenticated callers who hold any validly signed OIDC token from an accepted issuer (for example a GitHub Actions token from a repository they own) and who know or guess a target owner/repo plus identity name can read the policy's issuer, subject and audience patterns, claim_pattern regexes, and app pin details - information that frequently names internal repositories, branches, environments or cloud account identifiers, even when the policy lives in a private repository. The flaw is confidentiality-only: no token minting or trust-policy bypass is possible; the vendor issued a fix in v0.11.2 (commit 88c6432), and no public exploit was identified at time of analysis.
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
octokit/webhooks is a GitHub webhook events toolset for Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The mintToken function of a smart contract implementation for APP, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The App::Context module 0.01 through 0.968 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request to (1). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
OS command injection in Topluyo Desktop for Linux before 2026.9.2410 lets an unauthenticated attacker who controls a URL opened in the application execute arbitrary operating-system commands with the victim user's privileges. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (9.6), so exploitation requires the victim to open the crafted link but then crosses from the app into the OS with high confidentiality, integrity, and availability impact. The vendor advisory identifies 2026.9.2410 as the fix; no public exploit is identified at time of analysis, and the supplied priority label is act_now.
Off-origin preview framing in TinaCMS (tinacms <= 3.13.0 and @tinacms/app <= 2.5.13) lets an unauthenticated attacker who convinces a signed-in editor to open a crafted link such as `#/~//attacker.example/p` make the admin load and trust an attacker-controlled iframe, which is then accepted as the legitimate preview over the admin↔preview postMessage channel. Because the admin executes any GraphQL operation coming from that frame using the editor's own token, the attacker gains the editor's content API read and write access, exposing or modifying protected content. Exploitation needs only one click by an authenticated editor against a default configuration; no public exploit code was identified at time of analysis, and vendor-released patches are available in tinacms 3.14.0 and @tinacms/app 2.5.14.
Error messages returned by the Exchange RPC in Octo STS 0.11.1 and earlier disclose the contents of trust policies to callers whose OIDC token does not satisfy them. Remote, unauthenticated callers who hold any validly signed OIDC token from an accepted issuer (for example a GitHub Actions token from a repository they own) and who know or guess a target owner/repo plus identity name can read the policy's issuer, subject and audience patterns, claim_pattern regexes, and app pin details - information that frequently names internal repositories, branches, environments or cloud account identifiers, even when the policy lives in a private repository. The flaw is confidentiality-only: no token minting or trust-policy bypass is possible; the vendor issued a fix in v0.11.2 (commit 88c6432), and no public exploit was identified at time of analysis.
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
octokit/webhooks is a GitHub webhook events toolset for Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The mintToken function of a smart contract implementation for APP, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The App::Context module 0.01 through 0.968 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request to (1). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.