Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.
This issue affects Apache Sling Engine before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 have a vulnerability where a missing Content Security Policy (CSP) header could allow a remote authenticated attacker to bypass certain security restrictions. The issue is classified under CWE-693, indicating a protection mechanism failure. The vulnerability has a low severity score of 3.5 and does not impact confidentiality, integrity, or availability significantly.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 have a security vulnerability where the absence of the X-Content-Type-Options header allows MIME type sniffing. This can enable a remote authenticated attacker to bypass security restrictions. The vulnerability is classified under CWE-693 (Protection Mechanism Failure) and has a medium severity rating with a CVSS score of 5.4.
CVE-2026-93325 is a vulnerability in Docker Buildx where the protection mechanism requiring user consent before allowing builds to access paths outside the working directory can be bypassed when using the --progress=rawjson option. This causes the consent step to be skipped, potentially allowing unauthorized access during the build process. The issue affects Docker Buildx versions from 0.21.0 up to but not including 0.37.2 and has been fixed in version 0.37.2.
CVE-2026-44267 is a critical cross-site scripting (XSS) vulnerability in the Elo expression language used by enspirit. Versions prior to 1.0.1 allow attacker-controlled strings to execute arbitrary JavaScript code via the .constructor.constructor property. This flaw affects the defaultFormats.elo.parse() function, the bin/elo CLI, and the elo-lang.org/try playground, enabling browser script execution and session compromise. It also permits arbitrary Node.js code execution in environments using the library. The issue is fixed in version 1.0.1.
Apache Wicket versions 10.10.0, 10.11.0, and 9.24.0 have a vulnerability where Content-Security-Policy (CSP) headers are not set on pages if the render request handler is wrapped in multiple IRequestHandlerDelegate layers. This occurs because the framework only unwraps one delegate level, causing pages to be served without CSP headers despite CSP being enabled. This loss of nonce-based protection for inline scripts and styles exposes affected pages to content injection risks. Versions prior to 10.10.0 and 9.24.0 handled nested delegates correctly. Upgrading to versions 10.12.0 or 9.25.0 resolves the issue.
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538).
Trail of Bits fickling versions up to 0.1.12 contain a protection mechanism failure where the _process_import() method trusts imported callables from standard library modules without verifying their behavior. This leads to unsafe calls being marked as likely safe, allowing malicious pickle payloads to execute arbitrary code or write files. The issue affects Python 3.7 through 3.12 and involves modules such as dataclasses, mailcap, and readline. The vendor has added the demonstrated unsafe modules to a denylist on the master branch but no official release patch is available yet.
CVE-2026-87878 is a vulnerability in Acronis Cyber Protect 17 for Linux where the Linux binaries have the executable stack attribute enabled, which is a protection mechanism failure. This issue affects versions before build 42587. The vulnerability has a CVSS 3.0 score of 6.3, indicating a medium severity level. It allows an attacker with local access and low privileges to potentially execute code with high impact on confidentiality and integrity but no impact on availability. A fix is available in build 42587.
CVE-2026-87100 is a low-severity vulnerability in Acronis Cyber Protect 17 for Linux, caused by missing binary hardening in Linux executables. This protection mechanism failure affects versions before build 42587. The flaw could allow limited local attacker impact with low confidentiality and integrity consequences but no availability impact.
baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 have a vulnerability in the public API endpoint for mail message submissions that allows unauthenticated attackers to bypass CAPTCHA verification. This enables automated spam submissions without solving the image challenge, potentially causing administrator inbox spam, sending unwanted auto-replies, and database record accumulation. The issue is fixed in versions 5.3.2 and 5.4.2.
CVE-2026-57144 is a high-severity vulnerability in MervinPraison's PraisonAI multi-agent teams system affecting versions from 4.5.110 up to but not including 4.6.61. The issue arises when the SandlockSandbox fallback mechanism activates on systems where the Landlock security module is unavailable. Instead of enforcing filesystem and network restrictions, the fallback SubprocessSandbox does not enforce these boundaries, allowing sandboxed code to access unauthorized files and open network connections despite restrictions. This flaw has been fixed in version 4.6.61.
CVE-2026-56838 is an OS command injection vulnerability in MervinPraison's PraisonAI affecting versions from 4.5.87 up to but not including 4.6.59. The issue arises because the streaming execution path recipe.run_stream() bypasses the dangerous tool policy check that is enforced in the normal recipe.run() path. This allows execution of commands that should be denied unless explicitly allowed. The vulnerability has been fixed in version 4.6.59.
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.
Authlib versions prior to 1.8.0 contain an open redirect vulnerability due to improper handling of loopback HTTP exemptions in the is_secure_transport() function. This flaw allows an attacker to bypass TLS enforcement by supplying a URL with userinfo that begins with a loopback host, potentially causing cleartext redirection or acceptance of cleartext endpoints. The vulnerability does not bypass exact redirect URI matching and does not enable token forgery or user authentication bypass. The issue is fixed in version 1.8.0.
CVE-2026-114139 is a critical vulnerability in the Sentry-Javascript SDK's webpack integration for @sentry/nextjs. Versions from 9.36.0 up to but not including 9.47.2, 10.0.0-alpha.0 up to 10.75.2, and 11.0.0-alpha.0 up to 11.0.0-rc.1 are affected. The issue arises when the configured tunnelRoute causes the webpack integration to skip application middleware for request paths under that route, allowing unauthenticated requests to reach protected routes if they collide with the tunnel path or a root dynamic segment. This can lead to unauthorized access when middleware is the sole authorization mechanism. The vulnerability is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.
### Summary
OGNL's optional *stricter invocation* mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as `Runtime`, `ProcessBuilder`, and `ClassLoader`. The block list filters on the **declaring class of the method OGNL invokes**. Because `java.lang.reflect.Method` (and `Constructor`/`Field`) are not on the list, an expression can use reflection as a proxy — `someMethod.invoke(target, args)` — to reach a blocked method. The real call (e.g. `ProcessBuilder.start()`) then executes inside the JDK reflection machinery and never passes back through OGNL's `invokeMethod`, so the block list never sees it.
### Proof of concept
Under the default OGNL context (public-only access, stricter invocation enabled), the following expression creates a file even though a direct `new ProcessBuilder(...).start()` is blocked:
```
(#pb=new java.lang.ProcessBuilder({"/usr/bin/touch","rce-proof.txt"}),
#methods=@java.lang.ProcessBuilder@class.getMethods(),
#names=#methods.{ #this.getName() },
#startIdx=#names.indexOf("start"),
#methods[#startIdx].invoke(#pb, null))
```
### Impact and scope — please read carefully
**This is hardening of a defense-in-depth secondary layer, not a break of OGNL's primary security boundary.**
In OGNL the stricter-invocation block list is a *secondary* mitigation. The **primary** access-control gate is the `MemberAccess` implementation supplied by the integrating framework or application, which OGNL consults on every constructor and method call. Frameworks that evaluate untrusted expressions are expected to install a restrictive `MemberAccess` — for example, Apache Struts' `SecurityMemberAccess`, which excludes dangerous classes and the `java.lang.reflect` package. Against such a `MemberAccess` this PoC is blocked at the very first step (the `new ProcessBuilder(...)` constructor), before reflection is ever reachable.
The default context that ships with OGNL intentionally allows all public members and is **not** designed to sandbox untrusted input. An application that evaluates attacker-controlled expressions with that permissive default already has many paths to code execution, and this technique is not required to achieve it.
**You are affected only if all of the following hold:** (1) your application evaluates untrusted/attacker-controlled OGNL expressions, (2) it uses OGNL's default permissive `MemberAccess` (or an equivalently permissive one that allows `java.lang.reflect`), and (3) it relies on the stricter-invocation block list as its sandbox. **Properly configured consumers — including Apache Struts with its `SecurityMemberAccess` — are not affected.** The actual protection for untrusted-expression scenarios remains a correctly configured `MemberAccess`; the block list should not be treated as a sandbox.
### Fix
`java.lang.reflect.Method`, `java.lang.reflect.Constructor`, and `java.lang.reflect.Field` are added to the stricter-invocation block list, so reflection objects can no longer be used as invocation proxies in stricter mode. The `java.lang.invoke.MethodHandle` path was verified not to be exploitable (its signature-polymorphic `invoke`/`invokeExact` fail through OGNL's reflection-based invocation), so no additional classes are required.
### Credit
Reported responsibly through Tidelift by 毛锐 (youyi.mr@alibaba-inc.com).
CVE-2026-77474 is a high-severity vulnerability in destructive_command_guard (dcg), a command-line safety tool that blocks destructive shell commands before AI coding agents execute them. Versions prior to 0.6.6 are affected by uncontrolled resource consumption due to recursive rescanning triggered by nested or unclosed substitution sequences like $( or $((. This leads to exponential-time processing and can cause the PreToolUse hook to hang and fail open, allowing destructive commands to proceed. The issue is fixed in version 0.6.6.
Podman versions from 4.4.0 up to but not including 5.8.8, and from 6.0.0 up to but not including 6.1.3, contain a vulnerability where the 'podman run' command treats images with the io.podman.annotations.checkpoint.runtime.name annotation as checkpoints. This causes the tool to ignore user-supplied container creation restrictions such as --cap-drop=ALL, potentially allowing weaker sandbox settings and capabilities. Rootless containers are not affected. The issue is fixed in versions 5.8.8 and 6.1.3.
A vulnerability in the Python expression evaluator asteval prior to version 1.0.9 allows an attacker to bypass sandbox restrictions. The issue arises because the default Interpreter with numpy enabled exposes a ctypes type and permits memory access via from_address. This enables an attacker-controlled expression to read or write arbitrary process memory, potentially crashing the host or disclosing secrets. The vulnerability is fixed in version 1.0.9.