Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
← home

Security

Published security reports across the stacks we cover, newest first.

92 items
LOW
1.9
SECURITY PHP packages · 4 sources · 4h ago
CVE-2026-107848 — Contao: CSRF in backend actions
Contao contains a cross-site request forgery (CSRF) bug that allows authenticated backend users to trigger state-changing backend actions via specially crafted URLs. The issue is fixed in 5.3.50 and 5.7.12. (CVE-2026-107848, GHSA-9ff2-p842-45wq).
LOW
2.5
SECURITY Node.js & npm · 2 sources · 4h ago
fast-jwt: Verifier cache accepts expired JWTs (CVE-2026-107719)
fast-jwt's createVerifier cache can accept a previously valid signed JWT after its exp time when caching is enabled and the token has exp but no iat. The issue is fixed in 6.3.4. (Sources: OSV, NVD)
LOW
2.6
SECURITY PHP packages · 4 sources · 4h ago
Contao: improper access control in TableAccessVoter (CVE-2026-107851)
A caching bug in contao/core-bundle's TableAccessVoter can let a low-privileged backend user access tables outside assigned module permissions; the issue is fixed in 5.7.12. (CVE-2026-107851)
LOW
2.6
SECURITY PHP packages · 4 sources · 4h ago
Contao: Improper access control in preview links (CVE-2026-107850)
A flaw in contao/core-bundle allows non-admin backend users with the preview_link module to list tl_preview_link records, obtain signed share URLs from other users, and view unpublished pages they lack permission for. The issue is fixed by the vendor in 5.7.12. (Sources: 3965, 4166, 8435, 32350)
LOW
2.8
SECURITY Node.js & npm · 2 sources · 4h ago
msgpack5: Decoding negative int64 mutates input buffer (CVE-2026-107296)
msgpack5 updates to 6.1.0 fix an issue where decoding a negative signed 64-bit integer can overwrite bytes in the caller-provided input buffer, causing silent corruption of retained or reused encoded data. (CVE-2026-107296, GHSA-qw35-55vc-rhgj)
LOW
3.0
SECURITY PHP packages · 4 sources · 4h ago
CVE-2026-107380: Stored XSS in enshrined/svg-sanitize via DTD entity / HTML5 named character reference collision
A stored XSS issue in enshrined/svg-sanitize allows a crafted DTD entity to bypass href validation and survive serialization, enabling a javascript: URL when the sanitized SVG is embedded inline. The issue is fixed in 1.0.0. (Sources: GHSA, OSV, NVD)
LOW
3.4
SECURITY Node.js & npm · 2 sources · 4h ago
fast-jwt: clockTolerance = Infinity bypasses exp/nbf and persists in verifier cache (CVE-2026-107721)
fast-jwt accepted Infinity for clockTolerance, letting exp and nbf checks always pass and allowing expired or not-yet-active JWTs to be accepted. Verifier cache entries created under that configuration can remain valid until eviction. The issue is fixed in 6.3.0. [CVE-2026-107721, GHSA-687g-22h4-j4w4]
LOW
3.6
SECURITY Node.js & npm · 2 sources · 4h ago
music-metadata: EBML VINT length trusted, allowing memory exhaustion (CVE-2026-107389)
An EBML parser in music-metadata trusted an attacker-controlled VINT element length when allocating strings or Uint8Arrays, allowing crafted WebM/MKV/MKA inputs to cause disproportionate memory allocations, out-of-memory denial-of-service, or an uncatchable runtime abort observed on a demonstrated parse path. The issue is fixed in 11.16.0. (CVE-2026-107389)
LOW
3.6
SECURITY Node.js & npm · 3 sources · 4h ago
music-metadata: Uncontrolled memory allocation in APEv2 parser (CVE-2026-107387)
An APEv2 parser bug in music-metadata can allocate large buffers based on attacker-controlled tag sizes, causing process memory exhaustion. Fixed in 11.16.0. (CVE-2026-107387, GHSA-53v6-4h7p-p4gj)
MED
4.7
SECURITY Node.js & npm · 3 sources · 1d ago
CVE-2026-108259 — Code injection in @tinacms/cli from unescaped Git branch name
A code-injection vulnerability in @tinacms/cli allows a crafted Git branch name to inject code into a generated client module used during preview builds. The issue is fixed in 3.0.0. (Sources: 4023, 32645, 32357)
MED
5.7
SECURITY Node.js & npm · 3 sources · 1d ago
CVE-2026-108261 — TinaCMS admin preview can load attacker origin via URL fragment
An origin-validation flaw in TinaCMS admin preview can allow an attacker-controlled origin to be framed and treated as a trusted GraphQL preview, enabling GraphQL reads or mutations using an editor's credentials. (CVE-2026-108261, GHSA-x34j-47hf-4xg7)
MED
4.2
SECURITY Node.js & npm · 3 sources · 1d ago
CVE-2026-108260: stored XSS in @tinacms/web-components (tina-markdown)
The tina-markdown element in @tinacms/web-components wrote rich-text link URLs into anchor href attributes without validating the URL scheme, allowing stored cross-site scripting. The issue is fixed in 0.2.1. (Sources: OSV, GitHub Advisory, NVD) [4024,32643,32358]
LOW
3.7
SECURITY PHP packages · 4 sources · 1d ago
Contao search index disclosure — CVE-2026-107842
A Contao search module can disclose protected page titles, URLs and indexed snippets to unauthenticated visitors when contao.search.index_protected is switched from enabled to disabled. Fixed in vendor updates.
LOW
3.7
SECURITY PHP packages · 4 sources · 1d ago
CVE-2026-107843 — Contao registration module re-sends activation mails
A logic flaw in Contao's registration module can be triggered by unauthenticated POST requests to resend activation emails without rate limiting, allowing repeated emails and an observable difference that reveals whether a pending registration exists. Fixed in vendor updates.
LOW
3.7
SECURITY PHP packages · 4 sources · 1d ago
Contao path-traversal in ImagesController (CVE-2026-107844)
Contao's ImagesController can be abused via a user-controlled path parameter to return files from the project tree when names match allowed image extensions. Vendor updates fix the issue.
MED
5.7
SECURITY PHP packages · 4 sources · 1d ago
CVE-2026-107845 — XSS in contao/comments-bundle exposes backend when moderators view comments
The contao/comments-bundle contains a stored cross-site scripting flaw that allows an unauthenticated visitor to submit a comment whose email or website metadata is rendered without proper attribute/URL encoding. When a backend user opens the Comments module, attacker-controlled script can run in the Contao backend origin under that user's session. Fixed in updates supplied by the vendor. (Identifiers: CVE-2026-107845, GHSA-628f-v4f6-p37r, PKSA-c42s-m9fj-8jxw.)
MED
4.0
SECURITY WordPress · 2 sources · 2d ago
CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields
Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324]
MED
5.7
SECURITY WordPress · 4 sources · 2d ago
WP Rocket: CVE-2026-97076 and CVE-2026-97075
Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092]
MED
4.0
SECURITY Node.js & npm · 2 sources · 2d ago
Open redirect via unencoded route parameters in @adonisjs/http-server (CVE-2026-107718)
A missing encodeURIComponent call in @adonisjs/http-server's URL helper can allow attacker-controlled first path segments to produce scheme-relative external URLs, enabling open redirects. Fixed in 8.2.3 and 9.3.0. (CVE-2026-107718)
MED
4.9
SECURITY Node.js & npm · 2 sources · 2d ago
fast-jwt: createVerifier accepts unsigned JWTs when key is empty and algorithms is set (CVE-2026-107720)
A vulnerability in fast-jwt's createVerifier can allow an attacker to submit unsigned JWTs that bypass signature verification when the verifier key is an empty string or null and an algorithms allowlist is provided. The issue is fixed in 6.3.1. [CVE-2026-107720] [GHSA-8wpc-h4q6-8fxv]
MED
6.2
SECURITY Node.js & npm · 2 sources · 2d ago
fast-jwt: CVE-2026-107722 — RSA→HS256 algorithm confusion
A parsing bug in fast-jwt can misidentify RSA public-key text as an HMAC secret when non-whitespace characters precede the PEM header, allowing RSA public material to be used to sign HS256 tokens. The issue is fixed in fast-jwt 6.3.0. [sources: 4097, 31979]
MED
4.7
SECURITY Node.js & npm · 2 sources · 2d ago
fast-jwt silent claim-validator bypass — CVE-2026-107723
fast-jwt's verifier accepted JWTs whose payload is a JSON array instead of an object, causing configured claim checks (exp, aud, iss, etc.) to be skipped and allowing bypass of expiry and other protections. Fixed in 6.3.0. (CVE-2026-107723 / GHSA-5hjw-83fp-phq9)
MED
4.9
SECURITY Node.js & npm · 2 sources · 2d ago
fast-jwt treats raw public JWK JSON as HMAC secret — CVE-2026-107724
fast-jwt incorrectly classifies raw serialized public JWK/JWKS JSON as symmetric HMAC key material, allowing an attacker who knows the exact serialized bytes to forge HS256 tokens that verify. Fixed in 6.3.0. (CVE-2026-107724, GHSA-g3jj-5cmm-3hxx)
LOW
3.6
SECURITY Node.js & npm · 2 sources · 2d ago
CVE-2026-107391 — music-metadata: MP4 stsd sample-entry size==0 can cause synchronous infinite loop (DoS)
A regression in the MP4 stsd sample-description parser in music-metadata can let a crafted MP4-family input trigger a synchronous infinite loop that blocks the process event loop and grows memory until termination or exhaustion. The issue is tracked as CVE-2026-107391 (GHSA-f94x-6692-553q) and is fixed in music-metadata 11.16.0. [sources: 4115, 31908]
LOW
3.6
SECURITY Node.js & npm · 3 sources · 2d ago
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS (CVE-2026-107388)
An ID3v2 parser in music-metadata allocates memory based on the syncsafe tag-size without verifying input length, allowing a truncated file to trigger a large allocation and cause an availability-impacting failure. A fix is available in 11.16.0.
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email