Security Findings

The previous fix blocked dangerous paths like `phar://` by inspecting the file's "scheme", but CyStack researcher Trung Nguyen found that adding an extra slash - `phar:///evil.phar` - makes that inspection come back empty, so the guard waves the path straight through while PHP still opens the phar archive. He built a working exploit from this: on PHP 7.x, opening the crafted phar triggers PHP to automatically rebuild attacker-controlled objects from the file, which chains into running arbitrary commands and full server takeover; on PHP 8.x it becomes an arbitrary file read of secrets like config and key files. Because apps routinely let untrusted users upload spreadsheets, a single malicious file is enough to trigger it. Versions up to 1.30.4 are affected; 1.30.5 fixes it.

A flaw in Notepad++ lets an attacker run a malicious program on the victim's computer without their consent. An earlier fix was meant to block this by only trusting programs in safe system folders, but CyStack researcher Trung Nguyen found a way to slip past that check and reach a malicious file anyway. The bug affects Notepad++ v8.9.6.1 and is fixed in v8.9.6.2.

CyStack researcher Trung Nguyen discovered a way to run arbitrary code on an Apache Syncope server and proved it by escaping the platform's Groovy code sandbox. Syncope lets administrators supply small Groovy scripts ("Implementations") to customize identity-management logic, and these are meant to run inside a sandbox that blocks dangerous operations. Trung found that the sandbox never inspected a Groovy class's static initializer - the block of code that runs automatically the moment a class is loaded - so an administrator with the Implementation entitlement could hide untrusted code there and have it execute with no restrictions, taking full control of the server. Because the attacker needs a privileged account the impact is limited to insider or compromised-admin scenarios, but the result is complete remote code execution. The flaw affects Syncope 3.0.0-3.0.16, 4.0.0-4.0.5 and 4.1.0; upgrading to 4.0.6 or 4.1.1 - which forces even the static initializer to run inside the sandbox - fixes it.

A policy bypass vulnerability has been identified in the MNG decoder of ImageMagick. This issue could potentially allow unauthorized access to certain functionalities, impacting the security of applications that utilize this library.

A vulnerability has been identified in Caddy that allows for placeholder expansion injection through the use of literal key names. This issue could potentially lead to unintended behavior in the application, posing a high security risk. Users are advised to review the advisory for more details and apply necessary updates.

A vulnerability in n8n allows for credential exfiltration through a bypass of the Allowed HTTP Request Domains feature. This could potentially enable unauthorized access to sensitive information. Users are advised to review the advisory for mitigation steps.

The Frappe Framework has a critical vulnerability that allows arbitrary file reading through path traversal. This issue can potentially expose sensitive files on the server, leading to unauthorized access to confidential information.

PraisonAI is vulnerable to unauthenticated remote code execution (RCE) due to a flaw in the tool_override.py file. This vulnerability allows attackers to execute arbitrary code by providing a malicious recipe that points to a local path or a GitHub repository. The issue affects versions from 4.5.139 to before 4.6.32 and has been patched in version 4.6.32.

LangChain has a vulnerability that allows unsafe deserialization of attacker-controlled objects due to overly broad allowlists in the `load()` function. This could potentially lead to remote code execution if exploited. Users are advised to review the advisory for mitigation steps.

Path traversal in `write_tar_file_content` lets a dashboard admin write attacker-controlled bytes to any path the EMQX process can reach.

A critical remote code execution (RCE) vulnerability was discovered in Wekan, affecting versions 9.06 and earlier. This issue, known as AvatarBleed, was reported by Trung Nguyen from CyStack Security and has been fixed in version 9.07 released on May 2, 2026. Users are advised to upgrade to the latest version to mitigate this security risk.

ERPNext has a vulnerability that allows for SQL Injection due to insufficient input validation. This flaw could potentially be exploited by attackers to manipulate database queries, leading to unauthorized access to sensitive data. Users are advised to update their systems to mitigate this risk.

ERPNext has a vulnerability that allows for SQL Injection due to insufficient input validation. This could potentially allow attackers to manipulate database queries, leading to unauthorized data access or modification. Users are advised to update their systems to mitigate this risk.

A critical vulnerability in ERPNext allows unauthorized modification of documents due to a lack of proper validation. This issue could potentially lead to significant data integrity problems if exploited. Users are advised to review the advisory and apply necessary updates to mitigate the risk.

Joomla! has a vulnerability due to improper access checks in its webservice endpoints, which could allow unauthorized users to access sensitive information. This issue affects the com_config API, potentially leading to security breaches. Users are advised to update their Joomla! installations to mitigate this risk.

A SQL injection vulnerability has been identified in the Joomla! core, specifically within the articles webservice endpoint of the com_content component. This flaw arises from improperly constructed order clauses, which could allow attackers to manipulate database queries. Users are advised to update their Joomla! installations to mitigate this risk.

ManageEngine Exchange Reporter Plus versions 5723 and below are affected by a Stored XSS vulnerability in the Public Folders report. This vulnerability allows an attacker to inject malicious scripts into the application, potentially compromising user data and session integrity.

ManageEngine Exchange Reporter Plus versions 5723 and below are affected by a stored XSS vulnerability in the Folder Message Count and Size report. This vulnerability could allow an attacker to inject malicious scripts into the application, potentially compromising user data. Users are advised to review the advisory and apply necessary updates to mitigate the risk.

ManageEngine Exchange Reporter Plus versions 5723 and below are affected by a Stored XSS vulnerability in the Mails Deleted or Moved report. This vulnerability could allow an attacker to execute malicious scripts in the context of a user's session. Users are advised to review the advisory for mitigation steps.

ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to a Stored Cross Site Scripting (XSS) issue in the reports module. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of a user's session. Users are advised to update to the latest version to mitigate this risk.