Budibase: Privilege escalation via public role assignment API missing app-level authorization

### Summary Budibase `3.39.19` (commit `03fbabae4`) is affected by a privilege-escalation / missing-authorization flaw

历史摘要 · 未重新核验 · GitHub Advisory

react-server-dom: Denial of Service in Server Functions

CVE-2026-44907

### Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server fu

历史摘要 · 未重新核验 · GitHub Advisory

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

CVE-2026-53669

This is a follow up to [CVE-2025-68470](https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4

历史摘要 · 未重新核验 · GitHub Advisory

React Router: Open redirect leading to XSS

CVE-2026-53668

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external locat

历史摘要 · 未重新核验 · GitHub Advisory

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

CVE-2026-53667

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router

历史摘要 · 未重新核验 · GitHub Advisory

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

CVE-2026-53666

If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, the

历史摘要 · 未重新核验 · GitHub Advisory

find-my-way: DDoS with HTTP2

CVE-2026-47219

### Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that

历史摘要 · 未重新核验 · GitHub Advisory

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

CVE-2026-45623

## Summary PostCSS's `PreviousMap` parses the `/*# sourceMappingURL=PATH */` comment from any CSS string passed to `pro

历史摘要 · 未重新核验 · GitHub Advisory

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

### Impact `next-auth` (Auth.js) v5 applications that gate access by checking only for the **existence** of the `auth`

历史摘要 · 未重新核验 · GitHub Advisory

Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

## Summary The exported `getToken()` helper (`next-auth/jwt` and `@auth/core/jwt`) can throw an uncaught exception when

历史摘要 · 未重新核验 · GitHub Advisory

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

## Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address **befor

历史摘要 · 未重新核验 · GitHub Advisory

Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

## Summary Auth.js stores the OAuth/OIDC anti-CSRF checks (`state`, `nonce`, and the PKCE verifier) in global cookies t

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

## Impact The n8n Snowflake node's Execute Query operation interpolated expression values directly into the SQL string,

历史摘要 · 未重新核验 · GitHub Advisory

n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances

## Impact The Postgres Trigger node interpolated user-supplied identifier parameters (channel, function, and trigger na

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner

## Impact n8n's JavaScript task runner shared one module cache across all users' Code-node executions, so a user able t

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Server-Side Request Forgery in Server Actions on custom servers

CVE-2026-64649

## Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Cache confusion of response bodies for requests with bodies

CVE-2026-64648

## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to t

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

CVE-2026-64647

## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to t

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Unbounded Server Action payload in Edge runtime

CVE-2026-64646

## Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessiv

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

CVE-2026-64645

## Impact A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled in

历史摘要 · 未重新核验 · GitHub Advisory