CVE-2026-54594

OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording that the issue was already converted or otherwise suppressing duplicate runs. A user who creates one off-topic issue and repeatedly edits its description before conversion completes can therefore cause multiple discussions to be created for the same issue, producing discussion spam and additional moderation work. This issue is fixed with commit 627e0f0a16a7d74b09128106b57dd7e85d2545df.

• CWE-799

• https://github.com/OmniBlocks/monorepo/commit/2953ef77649fc3c206fc1ee306f74cedc31b67e3
• https://github.com/OmniBlocks/monorepo/commit/627e0f0a16a7d74b09128106b57dd7e85d2545df
• https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq
• https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq

Published

Sep 17, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54588Poweradmin is a web-based DNS administration tool for PowerD…9.6
• CVE-2026-5459The User Frontend: AI Powered Frontend Posting, User Directo…5.3
• CVE-2026-54590AsyncSSH is a Python package which provides an asynchronous …5.9
• CVE-2026-54591AsyncSSH is a Python package which provides an asynchronous …8.1
• CVE-2026-54592Oj (Optimized JSON) is a JSON parser and Object marshaller p…7.5
• CVE-2026-54593Pterodactyl is a free, open-source game server management pa…8.1
• CVE-2026-54596ITFlow provides an IT documentation, ticketing and accountin…8.1
• CVE-2026-54597ITFlow provides an IT documentation, ticketing and accountin…8.3
• CVE-2026-54598Wallos is an open-source, self-hostable personal subscriptio…7.5
• CVE-2026-54599Wallos is an open-source, self-hostable personal subscriptio…7.5
• CVE-2026-5460A heap use-after-free exists in wolfSSL's TLS 1.3 post-quant…6.5
• CVE-2026-54600Wallos is an open-source, self-hostable personal subscriptio…8.2