Vnth4Nhnt

**Name of the Vulnerable Software and Affected Versions** rclone versions prior to 1.74.4 **Description** The local backend fails to mask special permission bits when applying source-supplied mode metadata. This allows an attacker to set setuid or setgid bits on files they control. When copying files with metadata preservation from an untrusted remote source, an attacker can plant a setuid binary to escalate privileges to root if the process runs as root, or to the associated service account user. **Recommendations** Update rclone to version 1.74.4 or later.

**Name of the Vulnerable Software and Affected Versions** Simply Schedule Appointments versions prior to 1.6.12.3 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update Simply Schedule Appointments to version 1.6.12.3 or later.

**Name of the Vulnerable Software and Affected Versions** Hugo versions 0.162.0 through 0.163.0 **Description** The default `security.http.urls` policy fails to properly block requests to loopback, internal, and cloud-metadata IPv4 literals because the deny rule only matches dotted-decimal notation. Consequently, alternate IPv4 encodings such as integer, hex, or octal bypass the policy. When a template provides an untrusted or data-derived URL to the `resources.GetRemote()` function and the host platform utilizes the cgo system resolver, these encodings resolve to blocked addresses. This allows unauthorized build-time server-side requests to loopback and internal services, including cloud-metadata endpoints in hosted or CI builds. This bypass also applies to each redirect hop as the same check is reused. **Recommendations** Update to version 0.163.1.

**Name of the Vulnerable Software and Affected Versions** Daytona versions prior to 0.186 **Description** A sandbox volume reference `volumeId` (which may also be a volume name) was forwarded to the runner and used to build the host bind-mount source path without confinement. A reference containing path-traversal sequences—characters used to access files and directories outside the current working directory—could potentially resolve the mount source outside the intended per-volume base directory. If reachable, an authenticated user could cause the runner to bind-mount an unintended host path into their sandbox, potentially allowing read and write access to other tenants' volume data. **Recommendations** Update to version 0.186 or later.

**Name of the Vulnerable Software and Affected Versions** Daytona versions 0.101.0 through 0.184.0 **Description** A cross-tenant authorization flaw exists in the notification WebSocket gateway of the Daytona API service (`apps/api` NestJS application). The JWT handshake joins a client-supplied organization identifier to the corresponding notification room without verifying if the authenticated user is a member of that organization. This allows any authenticated user with knowledge of a target organization's UUID to subscribe to its realtime notification channel and passively receive events related to sandboxes, snapshots, volumes, and runners, including the data contained within those events. This results in a cross-tenant confidentiality break. The API-key authentication path is not affected. **Recommendations** Update to version 0.185.0.

**Name of the Vulnerable Software and Affected Versions** Daytona versions prior to 0.185.0 **Description** Organization role update and delete endpoints authorized the caller as an owner of the organization in the request path but mutated the target role using only its identifier without verifying the role belonged to that organization. This results in a cross-tenant broken access control (IDOR - Insecure Direct Object Reference), where an authenticated user owning any organization could modify permissions or delete a role belonging to a different organization if the role identifier is known. An attacker could overwrite a target role's name and permission set to escalate or strip privileges, delete the role, or observe the current permission set via the update response. **Recommendations** Update to version 0.185.0.

**Name of the Vulnerable Software and Affected Versions** Joomla CMS (affected versions not specified) **Description** Lack of output escaping in the multilingual associations component allows for a Cross-Site Scripting (XSS) vector. XSS is a flaw where an attacker injects malicious scripts into content delivered to other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 2.20.0 **Description** An issue in the "POST /rest/dynamic-node-parameters/options" endpoint allows authenticated users with credential access to bypass Allowed HTTP Request Domains restrictions. This enables an attacker to force the server to issue HTTP requests containing credentials to unauthorized hosts, leading to the exfiltration of sensitive authentication data. **Recommendations** Update to version 2.20.0 or later. Restrict n8n access to fully trusted users only. Limit credential sharing to users who genuinely require access to those credentials.

**Name of the Vulnerable Software and Affected Versions** ERPNext versions prior to 15.104.3 ERPNext versions prior to 16.14.0 **Description** Certain endpoints are susceptible to SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution, allowing an attacker to extract sensitive information via specially crafted requests. **Recommendations** Update to version 15.104.3. Update to version 16.14.0.

**Name of the Vulnerable Software and Affected Versions** ERPNext versions prior to 16.9.1 **Description** Certain endpoints in this open source Enterprise Resource Planning tool fail to enforce proper authorization checks, which allows users to modify data beyond the permissions assigned to their role. **Recommendations** Update to version 16.9.1.

Name of the Vulnerable Software and Affected Versions versions not specified Description Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint. The vulnerability exists due to a flaw in how order clauses are constructed, potentially allowing an attacker to inject malicious SQL code. The affected API endpoint is '/articles'. The vulnerability could allow an attacker to manipulate database queries through the `order` parameter. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** versions prior to 2026-23899 **Description** An improper access check allows unauthorized access to webservice endpoints. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.