CVE-2026-53954

Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service. Version 2.2.2 applies the configurable MAX_EVENT_TAGS limit before storage. The impact is limited to availability for an instance accepting the event and does not expose stored data, modify existing events, or allow code execution. This issue is fixed in version 2.2.2.

• CWE-400

• https://github.com/bugsink/bugsink/commit/1d0539fefcd1a796143d15d84053b1c0122ef8c7
• https://github.com/bugsink/bugsink/commit/8dca571b9e66c535ed4885465db820824e7c491a
• https://github.com/bugsink/bugsink/releases/tag/2.2.2
• https://github.com/bugsink/bugsink/security/advisories/GHSA-5x67-j5xg-c5gj

Published

Sep 15, 2026

Last Modified

Sep 15, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53948Ghost is a Node.js content management system. From 6.19.4 un…5.4
• CVE-2026-53949Ghost is a Node.js content management system. From 5.46.1 un…5.3
• CVE-2026-5395The Fluent Forms – Customizable Contact Forms, Survey, Quiz,…8.2
• CVE-2026-53950@tryghost/activitypub is Ghost’s social/federation client ap…7.5
• CVE-2026-53951Copier is a library and CLI app for rendering project templa…8.8
• CVE-2026-53952GetSimple CMS is a content management system (CMS), and GetS…9.8
• CVE-2026-53956Rattler is a library that provides common functionality used…5.4
• CVE-2026-53957Contentful MCP Server is a Model Context Protocol server for…7.7
• CVE-2026-539584gaBoards is a boards system for realtime project management…7.6
• CVE-2026-539594gaBoards is a boards system for realtime project management…6.5
• CVE-2026-5396The Fluent Forms plugin for WordPress is vulnerable to Autho…8.2
• CVE-2026-53960Discourse is an open-source discussion platform. Prior to 20…5.3