CVE-2026-119291 is a vulnerability in zuke-build's zuke automation system prior to version 1.4.0. It involves improper handling of symbolic links during setup and import operations, allowing an attacker to supply a malicious repository or template with symbolic links that cause files outside the intended directory to be overwritten with the user's permissions. This can lead to unauthorized modification of files. The issue is fixed in version 1.4.0.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.
CVE-2026-104615 is an authentication bypass vulnerability in SUSE Rancher Fleet's cluster registration flow affecting multiple versions before fixed releases. The flaw allows a registration request to claim a cluster identity without proper binding to the registration token, enabling association with a different managed cluster's identity. This could lead to unauthorized actions on clusters.
Zuke-build versions prior to 1.10.0 contain a vulnerability in the @zuke/gh githubWorkflow(...) gate where it insufficiently verifies the authenticity of dispatched workflow runs. The gate relies solely on a display-title marker visible in the workflow run list, which can be spoofed by an attacker with workflow_dispatch permission in an external repository. This allows an attacker to substitute a workflow run conclusion, potentially authorizing unvalidated releases or blocking valid ones. The issue is resolved in version 1.10.0.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.
CVE-2026-119287 is a missing authorization vulnerability in zuke-build's zuke prior to version 1.51.0. The vulnerability allows a registry writable by another party to specify commands and arguments that can be executed with the operator's environment and workspace access when using the mcp registry mode with the --allow-run option. This issue does not affect the local default registry or descriptors that enforce authorization. The flaw is fixed in version 1.51.0.
RT's automatic link creation for URLs in HTML ticket content does
not HTML-escape the URL it places in the link. A URL crafted to
break out of the link's address can add a script that runs when the
ticket history is displayed, with no further action by the viewer.
Anyone who can add HTML content to a ticket can plant it. That
includes an unauthenticated sender of HTML email to any queue that
grants CreateTicket or ReplyToTicket to Everyone, which is routine
for a queue that accepts mail from the public. The script runs in
the session of any user who views the ticket, and can act in RT
with that user's authority.
This issue was fixed in version 5.0.11 and 6.0.4
RTIR's ticket creation forms show the subject of the related
ticket when splitting a ticket or creating an incident from a
report, and they render that subject without HTML escaping. A
ticket subject containing script runs it when a user opens either
form. RTIR grants everyone the right to create Incident Reports by
default, so an unauthenticated sender of an emailed report can set
that subject. The script then runs in the session of the incident
handler who creates an incident from the report or splits it, and
can act in RT with that user's authority.
The issue was fixed in version 6.0.4. RTIR 5.0 is not
affected.
A stored cross-site scripting (XSS) vulnerability exists in the Blocksy Companion plugin for Creative Themes, affecting versions up to 2.1.60. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges and requiring user interaction to execute malicious scripts in the context of the affected application. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A deserialization of untrusted data vulnerability exists in the SubWorkflow task of Google Cloud Application Integration versions prior to 2026-09-11. This flaw allows an authenticated attacker to execute arbitrary code by submitting a maliciously crafted serialized object. The vulnerability was patched on September 11, 2026, and no customer action is required.
An improper access control vulnerability in the multi-factor authentication (MFA) feature of ManageEngine SharePoint Manager Plus (SPMP) allows a low-privileged authenticated user to bypass authorization checks. This enables reading and modifying MFA settings, enabling or disabling MFA, enumerating MFA-enrolled users, and deleting MFA-enrolled accounts. Exploitation could weaken authentication protections or cause denial of service by locking out legitimate users. The issue was fixed in build 4507; the vulnerability was demonstrated in build 4506.
Tamery versions from 0.26.1 up to but not including 0.99.0 contain an authorization bypass vulnerability in the cloud sync API's chatsMessages.update handler. This flaw allows authenticated Pro subscribers to modify another user's AI chat history by moving messages with arbitrary content if they know the victim's chat ID. The vulnerability impacts message integrity but does not affect confidentiality or availability.
WHartTest versions 2.2.0 through 2.8.1 have a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet. Authenticated users can exploit this flaw by setting the project_pk parameter to another project's ID, enabling them to access, modify, delete, or trigger scheduled tasks and read execution logs of other projects.
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. This allows attackers to inject malicious HTML or JavaScript into attributes used for generating charts, such as users' full names, site names, or group names. The malicious content is stored and executed in the browsers of other users viewing the affected charts. The vulnerability was fixed in client application build 4508.
Tamery versions from 0.32.0 up to but not including 0.99.0 contain a broken authorization vulnerability in the cloud sync API's connectionsResources.create handler. This flaw allows authenticated users to attach resources to other users' connections by including a victim's connectionId in a batch request. The vulnerability results in unauthorized resource insertion under a victim's connection context.
Songloft versions from 2.9.0 up to but not including 2.13.6 contain a hardcoded credentials vulnerability. This flaw allows attackers on the same network segment to authenticate as an administrator using a fixed username and password (admin/admin). Exploiting this vulnerability enables unauthorized modification of library and configuration settings and installation of JavaScript plugins executed in QuickJS.
Blossom through version 1.17.1 has an authorization bypass vulnerability that allows authenticated users to access and manipulate other users' folders. This occurs because the FolderService queries only filter by folder ID, enabling attackers to supply another user's folder ID to endpoints like /folder/info, /folder/upd, /folder/open, or /folder/del. As a result, attackers can read storage paths, rename folders, toggle visibility, or delete folders belonging to other users.
CoreShop by CoreUnion versions through 1.5.5 contain an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint. The flaw allows anonymous attackers to inject subqueries via the order parameter, bypassing SqlSugar's field validation. This can lead to extraction of member account and order data using boolean-based or time-based blind SQL injection techniques.
PowerDNS-Admin versions up to 2026.08.1 have an authorization bypass vulnerability. Authenticated users with User-role privileges can refresh secondary DNS zones they are not authorized to access by manipulating the 'domain' field in the JSON request body. This allows attackers with access to any one zone to trigger zone transfers (axfr-retrieve) of other users' secondary zones and potentially infer the existence of those zones based on response differences.
MuseBot versions before 2.0.0 have an authentication bypass vulnerability due to a hard-coded default session key. This flaw allows unauthenticated attackers to forge admin sessions by signing a session cookie with the known default key. Successful exploitation grants full administrative access, including reading password hashes, chat records, bot configuration, and the ability to stop bots.