Known Vulnerabilities for Forge by Digitalbazaar
Listed below are 9 of the newest known vulnerabilities associated with "Forge" by "Digitalbazaar".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-58593 json | NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. The inbound middl... | Not Provided | 2026-07-01 | 2026-07-07 |
| CVE-2026-58370 json | Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, p... | Not Provided | 2026-06-30 | 2026-07-02 |
| CVE-2026-58369 json | Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the Lo... | Not Provided | 2026-06-30 | 2026-06-30 |
| CVE-2026-57172 json | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default... | Not Provided | 2026-07-07 | 2026-07-08 |
| CVE-2026-56278 json | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-... | Not Provided | 2026-06-30 | 2026-07-01 |
| CVE-2026-56271 json | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_t... | Not Provided | 2026-07-12 | 2026-07-12 |
| CVE-2026-56265 json | Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docke... | Not Provided | 2026-06-21 | 2026-06-22 |
| CVE-2026-56244 json | Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-lev... | Not Provided | 2026-06-24 | 2026-06-24 |
| CVE-2026-56223 json | Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows a... | Not Provided | 2026-06-24 | 2026-06-24 |
| CVE-2026-55792 json | Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and ab... | Not Provided | 2026-07-02 | 2026-07-02 |