CVE-2026-35533

mise manages dev tools like node, python, cmake, and terraform. From 2026.2.18 through 2026.4.5, mise loads trust-control settings from a local project .mise.toml before the trust check runs. An attacker who can place a malicious .mise.toml in a repository can make that same file appear trusted and then reach dangerous directives such as [env] _.source, templates, hooks, or tasks.

• CWE-284

• https://github.com/jdx/mise/security/advisories/GHSA-436v-8fw5-4mj8Exploit, Vendor Advisory

Published

Apr 7, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35521FTLDNS (pihole-FTL) provides an interactive API and also gen…8.8
• CVE-2026-35523Strawberry GraphQL is a library for creating GraphQL APIs. S…7.5
• CVE-2026-35525LiquidJS is a Shopify / GitHub Pages compatible template eng…7.5
• CVE-2026-35526Strawberry GraphQL is a library for creating GraphQL APIs. P…7.5
• CVE-2026-35527Incus is an open source container and virtual machine manage…5
• CVE-2026-3553GitLab has remediated an issue in GitLab CE/EE affecting all…3.1
• CVE-2026-35534ChurchCRM is an open-source church management system. Prior …7.6
• CVE-2026-35535In Sudo through 1.9.17p2 before 3e474c2, a failure of a setu…7.8
• CVE-2026-35536In Tornado before 6.5.5, cookie attribute injection could oc…5.3
• CVE-2026-35537An issue was discovered in Roundcube Webmail before 1.5.14 a…7.5
• CVE-2026-35538An issue was discovered in Roundcube Webmail before 1.5.14 a…3.1
• CVE-2026-35539An issue was discovered in Roundcube Webmail before 1.5.14 a…6.1