Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

en

Security Research

Security Findings

CVEs, bug bounty submissions and public research from CyStack security researchers - disclosed responsibly and shared with the community.

Total disclosures

Vulnerabilities (32)

All severities(32)

All years

All vendors

All researchers

Newest first

Showing 20 of 32 vulnerabilities

ID

Title

Vendor / Product

Severity

CVSS

Researcher

Published

ImageMagick Policy Bypass in MNG decoder

A policy bypass vulnerability has been identified in the MNG decoder of ImageMagick. This issue could potentially allow unauthorized access to certain functionalities, impacting the security of applications that utilize this library.

policy-bypassvulnerabilityimagemagick

GHSA-wwhq-w58m-w29c

Caddy vars_regexp Placeholder Expansion Injection via Literal Key Names

A vulnerability has been identified in Caddy that allows for placeholder expansion injection through the use of literal key names. This issue could potentially lead to unintended behavior in the application, posing a high security risk. Users are advised to review the advisory for more details and apply necessary updates.

injectionplaceholderhigh-severity

GHSA-3875-8gcx-7v46

n8n Credential exfiltration via Allowed HTTP Request Domains Bypass

A vulnerability in n8n allows for credential exfiltration through a bypass of the Allowed HTTP Request Domains feature. This could potentially enable unauthorized access to sensitive information. Users are advised to review the advisory for mitigation steps.

auth-bypasscredential-exfiltration

Frappe Framework Arbitrary File Read via Path Traversal

The Frappe Framework has a critical vulnerability that allows arbitrary file reading through path traversal. This issue can potentially expose sensitive files on the server, leading to unauthorized access to confidential information.

path-traversalfile-readcritical

Frappe Framework

PraisonAI - Unauthenticated RCE via tool_override.py

PraisonAI is vulnerable to unauthenticated remote code execution (RCE) due to a flaw in the tool_override.py file. This vulnerability allows attackers to execute arbitrary code by providing a malicious recipe that points to a local path or a GitHub repository. The issue affects versions from 4.5.139 to before 4.6.32 and has been patched in version 4.6.32.

rceunauthenticatedvulnerability

LangChain - Unsafe deserialization of attacker-controlled LangChain objects

LangChain has a vulnerability that allows unsafe deserialization of attacker-controlled objects due to overly broad allowlists in the `load()` function. This could potentially lead to remote code execution if exploited. Users are advised to review the advisory for mitigation steps.

rcedeserializationsecurity

EMQX plugin install zip slip

A vulnerability was identified in the EMQX plugin installation process, known as zip slip, which could allow attackers to exploit the system by manipulating file paths during the extraction of zip files. This issue has been addressed in recent pull requests that implement a fix along with additional security measures such as TTL and sha256-pinning for the install allowlist.

zip-slipsupply-chainsecurity-fix

wekan-avatar-bleed

Wekan Avatar RCE

A critical remote code execution (RCE) vulnerability was discovered in Wekan, affecting versions 9.06 and earlier. This issue, known as AvatarBleed, was reported by Trung Nguyen from CyStack Security and has been fixed in version 9.07 released on May 2, 2026. Users are advised to upgrade to the latest version to mitigate this security risk.

rcevulnerabilitysecurity+2

ERPNext - Possibility of SQL Injection due to missing validation

ERPNext has a vulnerability that allows for SQL Injection due to insufficient input validation. This flaw could potentially be exploited by attackers to manipulate database queries, leading to unauthorized access to sensitive data. Users are advised to update their systems to mitigate this risk.

sql-injectionvulnerabilityhigh-severity

ERPNext - Possibility of SQL Injection due to missing validation

ERPNext has a vulnerability that allows for SQL Injection due to insufficient input validation. This could potentially allow attackers to manipulate database queries, leading to unauthorized data access or modification. Users are advised to update their systems to mitigate this risk.

sql-injectionvulnerabilityhigh-severity

ERPNext - Unauthorised Document modification due to missing validation

A critical vulnerability in ERPNext allows unauthorized modification of documents due to a lack of proper validation. This issue could potentially lead to significant data integrity problems if exploited. Users are advised to review the advisory and apply necessary updates to mitigate the risk.

auth-bypassdata-integritycritical

Joomla! Core - Improper access check in webservice endpoints

Joomla! has a vulnerability due to improper access checks in its webservice endpoints, which could allow unauthorized users to access sensitive information. This issue affects the com_config API, potentially leading to security breaches. Users are advised to update their Joomla! installations to mitigate this risk.

auth-bypassaccess-controlwebservice

Joomla! Core SQL injection

A SQL injection vulnerability has been identified in the Joomla! core, specifically within the articles webservice endpoint of the com_content component. This flaw arises from improperly constructed order clauses, which could allow attackers to manipulate database queries. Users are advised to update their Joomla! installations to mitigate this risk.

sql-injectionjoomlavulnerability

ManageEngine Exchange Reporter Plus - Stored XSS in Public Folders report

ManageEngine Exchange Reporter Plus versions 5723 and below are affected by a Stored XSS vulnerability in the Public Folders report. This vulnerability allows an attacker to inject malicious scripts into the application, potentially compromising user data and session integrity.

xssvulnerabilitymanageengine

Exchange Reporter Plus

ManageEngine Exchange Reporter Plus - Stored XSS in Folder Message Count and Size report

ManageEngine Exchange Reporter Plus versions 5723 and below are affected by a stored XSS vulnerability in the Folder Message Count and Size report. This vulnerability could allow an attacker to inject malicious scripts into the application, potentially compromising user data. Users are advised to review the advisory and apply necessary updates to mitigate the risk.

xssvulnerabilitymanageengine

Exchange Reporter Plus

ManageEngine Exchange Reporter Plus - Stored XSS in Mails Deleted or Moved report

ManageEngine Exchange Reporter Plus versions 5723 and below are affected by a Stored XSS vulnerability in the Mails Deleted or Moved report. This vulnerability could allow an attacker to execute malicious scripts in the context of a user's session. Users are advised to review the advisory for mitigation steps.

xssvulnerabilitymanageengine

Exchange Reporter Plus

ManageEngine Exchange Reporter Plus - Stored XSS in reports module

ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to a Stored Cross Site Scripting (XSS) issue in the reports module. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of a user's session. Users are advised to update to the latest version to mitigate this risk.

xsssecurityvulnerability

Exchange Reporter Plus

ManageEngine Exchange Reporter Plus - Stored XSS in Instant Search option

ManageEngine Exchange Reporter Plus versions up to 5721 are affected by a Stored Cross Site Scripting (XSS) vulnerability in the Instant Search option. This vulnerability allows attackers to inject malicious scripts, which can be executed in the context of the user's session. Users are advised to review the provided advisory for mitigation steps.

xssvulnerabilitymanageengine

Exchange Reporter Plus

ManageEngine Exchange Reporter Plus - ReDoS in search module

ManageEngine Exchange Reporter Plus is affected by a Regular Expression Denial of Service (ReDoS) vulnerability in its search module. This vulnerability can be exploited by authenticated users to cause performance degradation. Users are advised to review the advisory for mitigation steps.

redosvulnerabilityauthenticated

Exchange Reporter Plus

Server-Side Request Forgery in astrojs

Astro, a web framework, has a vulnerability that allows attackers to bypass image proxy domain validation by using backslashes in the href parameter. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). The issue affects versions 5.13.4 to 5.13.9 and has been fixed in version 5.13.10.

ssrfxssvulnerability+1

CVE-2026-45664Medium

ImageMagick Policy Bypass in MNG decoder

A policy bypass vulnerability has been identified in the MNG decoder of ImageMagick. This issue could potentially allow unauthorized access to certain functionalities, impacting the security of applications that utilize this library.

ImageMagick is one of the most widely deployed image-processing libraries in the world, embedded in PHP, Python, Ruby, and Node.js stacks across millions of websites including Wikipedia, WordPress, Instagram, and Facebook. With more than 25 years of history and over 11,000 GitHub stars, vulnerabilities in ImageMagick have historically forced industry-wide patching affecting hundreds of millions of users (e.g. the 2016 "ImageTragick" disaster).

PhucND5.3May 16, 2026

GHSA-wwhq-w58m-w29cHigh

Caddy vars_regexp Placeholder Expansion Injection via Literal Key Names

A vulnerability has been identified in Caddy that allows for placeholder expansion injection through the use of literal key names. This issue could potentially lead to unintended behavior in the application, posing a high security risk. Users are advised to review the advisory for more details and apply necessary updates.

Caddy is a modern open-source web server written in Go with more than 60,000 GitHub stars, increasingly positioned as the next-generation alternative to Nginx and Apache. Known for its automatic HTTPS via Let's Encrypt and zero-config defaults, Caddy is used by enterprises and indie developers alike to serve hundreds of thousands of production websites and microservices.

TrungNHMay 13, 2026

GHSA-3875-8gcx-7v46Medium

n8n Credential exfiltration via Allowed HTTP Request Domains Bypass

A vulnerability in n8n allows for credential exfiltration through a bypass of the Allowed HTTP Request Domains feature. This could potentially enable unauthorized access to sensitive information. Users are advised to review the advisory for mitigation steps.

n8n is the leading open-source workflow-automation platform, with more than 90,000 GitHub stars and over 200,000 active workflows running in production at companies such as Cisco, Delivery Hero, and Microsoft. Often positioned as the open-source alternative to Zapier and Make, n8n is used by tens of thousands of teams to integrate APIs, automate business processes, and orchestrate AI agents.

ThanhNTBMay 13, 2026

CVE-2026-39352Critical

Frappe Framework Arbitrary File Read via Path Traversal

The Frappe Framework has a critical vulnerability that allows arbitrary file reading through path traversal. This issue can potentially expose sensitive files on the server, leading to unauthorized access to confidential information.

Frappe Framework

Frappe is a full-stack open-source Python/JavaScript web framework that serves as the foundation for ERPNext - one of the world's most-deployed open-source ERP systems. With more than 6,500 GitHub stars and a thriving community of self-hosting businesses, Frappe is used to run mission-critical enterprise applications across more than 1,000 companies in over 100 countries.

PhucNDMay 11, 2026

CVE-2026-44334Critical

PraisonAI - Unauthenticated RCE via tool_override.py

PraisonAI is vulnerable to unauthenticated remote code execution (RCE) due to a flaw in the tool_override.py file. This vulnerability allows attackers to execute arbitrary code by providing a malicious recipe that points to a local path or a GitHub repository. The issue affects versions from 4.5.139 to before 4.6.32 and has been patched in version 4.6.32.

PraisonAI is a fast-growing open-source multi-agent AI framework that lets developers orchestrate teams of LLM agents through low-code and no-code interfaces. It surpassed 5,000 GitHub stars in its first year and is increasingly adopted by AI startups and enterprises building autonomous-agent workflows on top of GPT, Claude, and open-source LLMs.

TrungNH8.4May 8, 2026

CVE-2026-44843High

LangChain - Unsafe deserialization of attacker-controlled LangChain objects

LangChain has a vulnerability that allows unsafe deserialization of attacker-controlled objects due to overly broad allowlists in the `load()` function. This could potentially lead to remote code execution if exploited. Users are advised to review the advisory for mitigation steps.

LangChain is the world's most popular framework for building LLM-powered applications, with more than 90,000 GitHub stars and tens of millions of monthly downloads on PyPI and npm. Used by virtually every major AI startup and Fortune 500 company experimenting with generative AI, LangChain forms the backbone of agent and RAG architectures across the entire industry.

PhucND8.2May 5, 2026

CVE-2026-44725High

EMQX plugin install zip slip

A vulnerability was identified in the EMQX plugin installation process, known as zip slip, which could allow attackers to exploit the system by manipulating file paths during the extraction of zip files. This issue has been addressed in recent pull requests that implement a fix along with additional security measures such as TTL and sha256-pinning for the install allowlist.

EMQX is the world's most scalable open-source MQTT broker, capable of handling more than 100 million concurrent IoT connections per cluster, and is used by Fortune 500 companies including HPE, Volkswagen, SAIC, Ericsson, and Siemens. Powering critical IoT infrastructure across automotive, manufacturing, energy, and smart-city deployments, EMQX has more than 14,000 GitHub stars and is the de-facto MQTT engine for industrial IoT.

TrungNHMay 4, 2026

wekan-avatar-bleedCritical

Wekan Avatar RCE

A critical remote code execution (RCE) vulnerability was discovered in Wekan, affecting versions 9.06 and earlier. This issue, known as AvatarBleed, was reported by Trung Nguyen from CyStack Security and has been fixed in version 9.07 released on May 2, 2026. Users are advised to upgrade to the latest version to mitigate this security risk.

Wekan is the most popular open-source kanban-board platform - widely regarded as the open alternative to Trello - with more than 19,000 GitHub stars. Self-hosted by governments, universities, and privacy-conscious enterprises across Europe and beyond, Wekan ships with Sandstorm, Cloudron, Univention, and Snap Store, with active deployments across tens of thousands of organisations.

TrungNHMay 2, 2026

CVE-2026-44447High

ERPNext - Possibility of SQL Injection due to missing validation

ERPNext has a vulnerability that allows for SQL Injection due to insufficient input validation. This flaw could potentially be exploited by attackers to manipulate database queries, leading to unauthorized access to sensitive data. Users are advised to update their systems to mitigate this risk.

ERPNext is the world's largest open-source ERP platform, used by more than 10,000 companies - from manufacturers and hospitals to government agencies - across 100+ countries to run accounting, HR, inventory, manufacturing, and CRM operations. Often referred to as the "open-source SAP", ERPNext competes directly with proprietary suites costing tens of thousands of dollars per seat.

ThanhNTB8.8Apr 30, 2026

CVE-2026-44446High

ERPNext - Possibility of SQL Injection due to missing validation

ERPNext has a vulnerability that allows for SQL Injection due to insufficient input validation. This could potentially allow attackers to manipulate database queries, leading to unauthorized data access or modification. Users are advised to update their systems to mitigate this risk.

ERPNext is the world's largest open-source ERP platform, used by more than 10,000 companies - from manufacturers and hospitals to government agencies - across 100+ countries to run accounting, HR, inventory, manufacturing, and CRM operations. Often referred to as the "open-source SAP", ERPNext competes directly with proprietary suites costing tens of thousands of dollars per seat.

ThanhNTB8.8Apr 30, 2026

CVE-2026-44442Critical

ERPNext - Unauthorised Document modification due to missing validation

A critical vulnerability in ERPNext allows unauthorized modification of documents due to a lack of proper validation. This issue could potentially lead to significant data integrity problems if exploited. Users are advised to review the advisory and apply necessary updates to mitigate the risk.

ERPNext is the world's largest open-source ERP platform, used by more than 10,000 companies - from manufacturers and hospitals to government agencies - across 100+ countries to run accounting, HR, inventory, manufacturing, and CRM operations. Often referred to as the "open-source SAP", ERPNext competes directly with proprietary suites costing tens of thousands of dollars per seat.

ThanhNTB9.9Apr 30, 2026

CVE-2026-23899High

Joomla! Core - Improper access check in webservice endpoints

Joomla! has a vulnerability due to improper access checks in its webservice endpoints, which could allow unauthorized users to access sensitive information. This issue affects the com_config API, potentially leading to security breaches. Users are advised to update their Joomla! installations to mitigate this risk.

Joomla! is one of the world's most popular open-source content management systems, ranking among the top three CMS platforms alongside WordPress and Drupal. It powers an estimated 1.5 million websites globally - including portals operated by government agencies, universities, and Fortune 500 companies - and has been downloaded over 110 million times since 2005, maintained by a global community of thousands of contributors.

ThanhNTB8.8Apr 1, 2026

CVE-2026-21630Medium

Joomla! Core SQL injection

A SQL injection vulnerability has been identified in the Joomla! core, specifically within the articles webservice endpoint of the com_content component. This flaw arises from improperly constructed order clauses, which could allow attackers to manipulate database queries. Users are advised to update their Joomla! installations to mitigate this risk.

Joomla! is one of the world's most popular open-source content management systems, ranking among the top three CMS platforms alongside WordPress and Drupal. It powers an estimated 1.5 million websites globally - including portals operated by government agencies, universities, and Fortune 500 companies - and has been downloaded over 110 million times since 2005, maintained by a global community of thousands of contributors.

ThanhNTB8.8Apr 1, 2026

CVE-2025-7632Medium

ManageEngine Exchange Reporter Plus - Stored XSS in Public Folders report

ManageEngine Exchange Reporter Plus versions 5723 and below are affected by a Stored XSS vulnerability in the Public Folders report. This vulnerability allows an attacker to inject malicious scripts into the application, potentially compromising user data and session integrity.

Exchange Reporter Plus

Exchange Reporter Plus is an enterprise reporting, auditing, and monitoring tool for Microsoft Exchange Server and Exchange Online, developed by Zoho's ManageEngine division. As part of the ManageEngine portfolio - used by more than 280,000 organisations including 9 of every 10 Fortune 100 companies - it manages mail-flow visibility and compliance reporting for some of the world's largest enterprise mail deployments.

KhanhVN7.3Nov 11, 2025

CVE-2025-7430Medium

ManageEngine Exchange Reporter Plus - Stored XSS in Folder Message Count and Size report

ManageEngine Exchange Reporter Plus versions 5723 and below are affected by a stored XSS vulnerability in the Folder Message Count and Size report. This vulnerability could allow an attacker to inject malicious scripts into the application, potentially compromising user data. Users are advised to review the advisory and apply necessary updates to mitigate the risk.

Exchange Reporter Plus

Exchange Reporter Plus is an enterprise reporting, auditing, and monitoring tool for Microsoft Exchange Server and Exchange Online, developed by Zoho's ManageEngine division. As part of the ManageEngine portfolio - used by more than 280,000 organisations including 9 of every 10 Fortune 100 companies - it manages mail-flow visibility and compliance reporting for some of the world's largest enterprise mail deployments.

KhanhVN7.3Nov 11, 2025

CVE-2025-7429Medium

ManageEngine Exchange Reporter Plus - Stored XSS in Mails Deleted or Moved report

ManageEngine Exchange Reporter Plus versions 5723 and below are affected by a Stored XSS vulnerability in the Mails Deleted or Moved report. This vulnerability could allow an attacker to execute malicious scripts in the context of a user's session. Users are advised to review the advisory for mitigation steps.

Exchange Reporter Plus

Exchange Reporter Plus is an enterprise reporting, auditing, and monitoring tool for Microsoft Exchange Server and Exchange Online, developed by Zoho's ManageEngine division. As part of the ManageEngine portfolio - used by more than 280,000 organisations including 9 of every 10 Fortune 100 companies - it manages mail-flow visibility and compliance reporting for some of the world's largest enterprise mail deployments.

KhanhVN7.3Nov 11, 2025

CVE-2025-5347Medium

ManageEngine Exchange Reporter Plus - Stored XSS in reports module

ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to a Stored Cross Site Scripting (XSS) issue in the reports module. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of a user's session. Users are advised to update to the latest version to mitigate this risk.

Exchange Reporter Plus

Exchange Reporter Plus is an enterprise reporting, auditing, and monitoring tool for Microsoft Exchange Server and Exchange Online, developed by Zoho's ManageEngine division. As part of the ManageEngine portfolio - used by more than 280,000 organisations including 9 of every 10 Fortune 100 companies - it manages mail-flow visibility and compliance reporting for some of the world's largest enterprise mail deployments.

KhanhVN6.3Oct 30, 2025

CVE-2025-5343Medium

ManageEngine Exchange Reporter Plus - Stored XSS in Instant Search option

ManageEngine Exchange Reporter Plus versions up to 5721 are affected by a Stored Cross Site Scripting (XSS) vulnerability in the Instant Search option. This vulnerability allows attackers to inject malicious scripts, which can be executed in the context of the user's session. Users are advised to review the provided advisory for mitigation steps.

Exchange Reporter Plus

Exchange Reporter Plus is an enterprise reporting, auditing, and monitoring tool for Microsoft Exchange Server and Exchange Online, developed by Zoho's ManageEngine division. As part of the ManageEngine portfolio - used by more than 280,000 organisations including 9 of every 10 Fortune 100 companies - it manages mail-flow visibility and compliance reporting for some of the world's largest enterprise mail deployments.

KhanhVN6.3Oct 30, 2025

CVE-2025-5342Medium

ManageEngine Exchange Reporter Plus - ReDoS in search module

ManageEngine Exchange Reporter Plus is affected by a Regular Expression Denial of Service (ReDoS) vulnerability in its search module. This vulnerability can be exploited by authenticated users to cause performance degradation. Users are advised to review the advisory for mitigation steps.

Exchange Reporter Plus

Exchange Reporter Plus is an enterprise reporting, auditing, and monitoring tool for Microsoft Exchange Server and Exchange Online, developed by Zoho's ManageEngine division. As part of the ManageEngine portfolio - used by more than 280,000 organisations including 9 of every 10 Fortune 100 companies - it manages mail-flow visibility and compliance reporting for some of the world's largest enterprise mail deployments.

KhanhVN4.3Oct 30, 2025

CVE-2025-59837High

Server-Side Request Forgery in astrojs

Astro, a web framework, has a vulnerability that allows attackers to bypass image proxy domain validation by using backslashes in the href parameter. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). The issue affects versions 5.13.4 to 5.13.9 and has been fixed in version 5.13.10.

Astro is a modern open-source web framework used by NASA, Google, IBM, The Guardian, Trivago, and Firebase to build content-heavy websites. With more than 50,000 GitHub stars and over 2 million weekly npm downloads, it has become the de-facto choice for content-first sites that demand extreme performance through its "zero JS by default" architecture.

TrungNH7.2Oct 28, 2025

Contact us via

Vietnam Office

Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam.
(+84) 247 109 9656

Canada Office

2376 Dundas St W, Toronto, Ontario M6P 0C1, Canada.
(+1) 437 361 5461

Security Testing & Assessment

Penetration Testing

CyStack VulnScan

Blockchain Audit

Data Protection

CyStack Endpoint

Data Leak Detection

Security Operations

Vulnerability Management

Digital Forensics (DFIR)

Training & Consulting

Company

Newsroom

Resource

Security Findings

Contact us via

ISMS ISO 27001:2022 and Quality Management Standard ISO 9001:2015 Compliance

© 2026 by CyStack JSC

ISMS ISO 27001:2022 and Quality Management Standard ISO 9001:2015 Compliance

© 2026 by CyStack JSC