🧭 Hashi Vault JS Flaw Enables Path and Query Injection
Teams using hashi-vault-js should upgrade to 0.5.2 promptly, especially where untrusted input can influence Vault identifiers or request parameters.
CVE-2026-55100 affects the hashi-vault-js Node.js module before version 0.5.2. Unencoded identifier values are inserted into Vault request paths and query strings, allowing path traversal and query parameter injection. The vulnerability is rated HIGH with CVSS 8.7 and is fixed in version 0.5.2.
🔗 Read more 🔗
Source: NVD
🧬 Defaults Deep Library Vulnerable to Prototype Pollution
JavaScript applications that merge user-supplied objects with this package should update to 2.0.5 quickly and review whether polluted prototype properties could affect authorization or application logic.
CVE-2026-54737 affects the @phun-ky/defaults-deep library before version 2.0.5. Its recursive merge function does not filter proto, constructor, or prototype properties, allowing attacker-controlled data to modify Object.prototype. The vulnerability is rated HIGH with CVSS 7.3 and is fixed in version 2.0.5.
🔗 Read more 🔗
Source: NVD
🌐 DSSRF DNS Handling Bug Reopens SSRF Paths
Services relying on DSSRF to validate user-controlled URLs should upgrade to 1.0.5 urgently, since a bypass could expose localhost services, cloud metadata endpoints, or internal networks.
CVE-2026-54729 affects the DSSRF Node.js library before version 1.0.5. Its is_url_safe check can incorrectly treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN and no dns.lookup fallback occurs, enabling server-side request forgery. The vulnerability is rated HIGH with CVSS 8.7 and is fixed in version 1.0.5.
🔗 Read more 🔗
Source: NVD
🔑 Vault Webhook Flaw Can Leak Kubernetes Service Account Tokens
Kubernetes operators using vault-secrets-webhook should upgrade to 1.23.1 immediately and inspect workloads for untrusted Vault address or service-account annotations.
CVE-2026-54725 affects vault-secrets-webhook before version 1.23.1. Attacker-controlled annotations can direct the webhook to a malicious Vault address and cause a Kubernetes ServiceAccount JWT to be transmitted there. The vulnerability is rated CRITICAL with CVSS 9.6 and is fixed in version 1.23.1.
🔗 Read more 🔗
Source: NVD
🗄️ cPanel Database Rename Flaw Enables Root-Context SQL Execution
cPanel administrators should apply the relevant vendor security update immediately and restrict database-management access until remediation is confirmed.
CVE-2026-58048 affects database-renaming functionality in cPanel. Improper preservation of SQL mode during a database rename can allow SQL to execute in root context. The vulnerability is rated CRITICAL with CVSS 9.4.
🔗 Read more 🔗
Source: NVD
💥 Malformed SFTP Handshake Can Crash Pterodactyl Wings
Pterodactyl operators exposing Wings SFTP services should upgrade to 1.13.0 promptly, as remote attackers may be able to disrupt server-management availability.
CVE-2026-52856 affects the Pterodactyl Wings server control plane before version 1.13.0. A malformed packet received during the SFTP connection handshake can trigger a Go panic and cause a denial of service. The vulnerability is rated HIGH with CVSS 7.5 and is fixed in version 1.13.0.
🔗 Read more 🔗
Source: NVD
🕵️ Pterodactyl Wings Templates Expose Sensitive Daemon Credentials
Pterodactyl administrators should upgrade to at least 1.12.3 immediately and rotate daemon tokens or registry credentials that may have been exposed to untrusted panel users.
CVE-2026-52855 affects Pterodactyl Wings before version 1.12.3. Low-privileged users can abuse config placeholders in egg configuration-file templates to read sensitive daemon settings, including tokens and Docker registry credentials. The vulnerability is rated CRITICAL with CVSS 9.9 and is fixed in version 1.12.3.
🔗 Read more 🔗
Source: NVD
🤖 Ansible Gateway mTLS Bypass Allows Malicious Event Injection
Organizations using Event-Driven Ansible should patch affected gateways urgently and review workflows for unexpected triggers, particularly when event-stream endpoints are externally reachable.
CVE-2026-18141 affects aap-gateway in Ansible Automation Platform Event-Driven Ansible. An unauthenticated remote attacker can manipulate an event-stream URL and forge the HTTP Subject header to bypass mTLS authentication, while error messages disclose the expected certificate subject. This can allow arbitrary event injection and unintended workflow execution, and the vulnerability is rated HIGH with CVSS 8.2.
🔗 Read more 🔗
Source: NVD
💻 pgAdmin Import Tool Injection Enables Operating-System Commands
pgAdmin deployments should move to a fixed release immediately, prioritizing shared or multi-user instances where non-administrators have Import and Export Data permission.
CVE-2026-17566 affects pgAdmin 4 versions containing the vulnerable Import and Export Data validation logic before 9.18. A mismatch between pgAdmin validation and PostgreSQL string parsing lets a user with the commonly granted tools_import_export_data permission escape the generated copy wrapper and inject a TO PROGRAM clause, resulting in operating-system command execution. The vulnerability is rated CRITICAL with CVSS 9.9.
🔗 Read more 🔗
Source: NVD
🧠 pgAdmin AI Assistant Bypass Reopens Database Write and RCE Risk
Anyone enabling the pgAdmin AI Assistant should upgrade to 9.17 or later immediately and treat content read by the assistant as a possible indirect prompt-injection source.
CVE-2026-17351 affects pgAdmin 4 from version 9.13 before 9.17. Differences between sqlparse and PostgreSQL string parsing allow multiple statements to be smuggled through the AI Assistant execute_sql_query validation, ending the read-only transaction and enabling database writes or potential command execution. The vulnerability is rated CRITICAL with CVSS 9.0 and is fixed by forcing the extended query protocol in version 9.17.
🔗 Read more 🔗
Source: NVD
🔓 pgAdmin Workspace Cloning Leaks Stored Database Credentials
Multi-user pgAdmin operators should upgrade to 9.17 immediately, audit cloned workspace server records, and rotate stored database or tunnel credentials where unauthorized access may have occurred.
CVE-2026-17349 affects pgAdmin 4 from version 9.0 before 9.17. The Workspaces adhoc connection endpoint can clone another user’s shared server record while retaining its ownership and stored credentials, allowing a non-owner to use database access belonging to another user. The vulnerability is rated CRITICAL with CVSS 9.6 and is fixed in version 9.17.
🔗 Read more 🔗
Source: NVD
🧨 pgAdmin Username Injection Leads to Service-Account Command Execution
Administrators using MASTER_PASSWORD_HOOK should upgrade to 9.17 urgently and review externally sourced usernames, authentication logs, and service-account activity for signs of command injection.
CVE-2026-17347 affects pgAdmin 4 from version 7.2 before 9.17 when MASTER_PASSWORD_HOOK is configured with a username placeholder. Usernames sourced from external authentication systems can contain shell metacharacters that are inserted into a shell command, allowing an authenticated attacker to execute arbitrary commands as the pgAdmin service account. The vulnerability is rated HIGH with CVSS 7.5 and is fixed in version 9.17.
🔗 Read more 🔗
Source: NVD