Security Report
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Check Point SmartConsole Improper Authentication Vulnerability
WordPress Core SQL Injection Vulnerability
WordPress Core Interpretation Conflict Vulnerability
Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
DD-WRT Stack-Based Buffer Overflow Vulnerability
CVE-2026-66012
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
The TypeScript Nunjucks renderer evaluated untrusted `.prompty` template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process.
## Affected packages
– npm `@…
CVE-2026-56163
CVE-2025-71389
CVE-2026-47668
CVE-2026-46412
@better-auth/scim: account takeover and stale access via SCIM provider-id collision
You are affected if your application registers the `@better-auth/scim` plugin and lets authenticated users generate SCIM tokens. The default `canGenerateToken` policy was affected, and custom policies were affected when they did not reject provider IDs already used by other accou…
CVE-2026-63732
CVE-2026-47752
CVE-2026-60402
CVE-2026-47392
CVE-2026-64459
tcp: restore RCU grace period in tcp_ao_destroy_sock
Commit 51e547e8c89c ("tcp: Free TCP-AO/TCP-MD5 info/keys without RCU")
removed the call_rcu() callback from tcp_ao_destroy_sock(), arguing that
"the destruction of info/keys is …
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
A pre-authentication remote code execution vulnerability affects OpenAM. The
remote authentication endpoint (`/authservice`, PLL) accepts an XML element
that names an arbitrary Java class, which the server then loads and
instantiates without validation. On a default configuration this is …
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
Remote Code Execution (RCE) in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq ("Prototype Pollution in #set path assignment") — that advisory blocked constructor/__proto__/prototype only in the #set assignment handler (se…
CVE-2026-64232
block: recompute nr_integrity_segments in blk_insert_cloned_request
blk_insert_cloned_request() already recomputes nr_phys_segments
against the bottom queue, because "the queue settings related to
segment counting may differ from …
CVE-2026-64216
netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it
is wanting to unlock and compares that to rreq->no_unlock_folio so that it
doesn't unlock …
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
A type confusion issue in `seroval.fromJSON()` allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records.
In applica…
CVE-2026-15981
CVE-2026-15015
CVE-2026-14282
CVE-2026-16606
Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
The Gitea Docker images ship an `app.ini` template that hard-codes:
“`
REVERSE_PROXY_TRUSTED_PROXIES = *
“`
The documented default for this setting, in `custom/conf/app.example.ini`, is `127.0.0.0/8,::1/128`, i.e. only loopback is trusted.
When an admin enables `ENABLE_REVERSE_PROXY_…
CVE-2026-59147
The attach-time validator dsu_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then…
CVE-2026-47410
CVE-2026-47391
OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check
When a SASL PLAIN bind supplies an authorization identity (authzid) that resolves to a **different** user, PlainSASLMechanismHandler verified only the PROXIED_AUTH privilege and never evaluated the "proxy" access-control right (the mayProxy ACI scope check). As a result, any account hold…
Budibase: SQL Injection via `multipleStatements: true`
A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands.
## Details
### Vulnerability Type
SQL Injection
### Description
The MySQL integration component in Budibase is configured with `multipleS…
CVE-2026-65606
CVE-2026-65605
CVE-2026-16424
CVE-2026-16419
Gitea: Public-only repository tokens can update private PR head branches
Gitea allows a `public-only,write:repository` token to update a private pull request head branch through a public base repository route.
The vulnerable endpoint is:
“`text
POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update
“`
Gitea checks the token's public-only re…
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
Gitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context while preserving the original HMAC signature. An attacker with permission to run a Gitea Actions job can turn a signed URL for an attacker-controlled artifac…
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
Gitea's default SSRF allow-list ([`MatchBuiltinExternal`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L26-L27), used by both webhook delivery and repository migrations) relies on Go's standard library [`net.IP.IsPriva…
CVE-2026-15901
CVE-2026-15900
CVE-2026-15899
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
The server defaults to CORS_ORIGINS=* combined with allow_credentials=True. Starlette's CORSMiddleware echoes the requesting origin in preflight responses when credentials are enabled, meaning every origin is effectively whitelisted for credentialed cross-origin requests. Any malicious w…
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
`sm-crypto` (npm package **0.4.0**, the latest release, published 2026-01-20)
generates SM2 private keys and signing ephemeral scalars from a single
module-wide RNG instance (`src/sm2/utils.js`: `const rng = new SecureRandom()`).
`SecureRandom` is jsbn's PRNG, which seeds an **ARC4** str…
CVE-2026-48021
kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
`ValidationHandler.Load()` in `getkin/kin-openapi` silently replaces a nil `AuthenticationFunc` with `NoopAuthenticationFunc`, which always returns `nil` without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every Open…
CVE-2026-60267
CVE-2026-47731
CVE-2026-59141
The attach-time validator rdx_validate_header checks the header scalars and region layout against the file size, but does not validate the node records it the…
CVE-2026-59140
The attach-time validator ss_validate_header bounds only the root index against the node pool (node_capacity). The order-statistics and min/max queries…
CVE-2026-28321
CVE-2026-28317
CVE-2026-28316
CVE-2026-28314
CVE-2026-28313
CVE-2026-28312
CVE-2026-28310
CVE-2026-28309
CVE-2026-28308
CVE-2026-28307
CVE-2026-28306
CVE-2026-28305
CVE-2026-28304
CVE-2026-28302
Shescape: Shell injection via unescaped parentheses on Windows with CMD
This impacts users of Shescape on Windows that explicitly configure `shell` to CMD, or `true` with the default shell being CMD, using the `escape` and `escapeAll` APIs.
An attacker may be able to achieve shell injection depending on the original command.
“`javascript
import * as cp fr…
Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
Budibase attaches a REST datasource's stored credentials (Bearer/Basic tokens and static headers) to an outgoing request before it decides which host the request goes to, and never checks that the destination host matches the datasource. A query's request path can be pointed at any host (…
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account **by email address alone**, without ever checking the `email_verified` claim of the OIDC ID token. Budibase first tries to match the IdP `sub`; when that misses (any fresh attacker IdP account) it si…
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an `ObjectInputFilter` meant to allow only `AuthenticatorImpl`, but it short-circuits to `ALLOWED` for any object at stream `depth > 1`. Because the Java serialization filter is consulted for every class in the…
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
`kiota info` — the command developers run to learn which packages to install after generating a client —
read the `x-ms-kiota-info` extension from the OpenAPI description and presented the spec-supplied
`dependencyInstallCommand` (and dependency `name`/`version`) **as the tool's own…
Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
`kiota plugin add` / `kiota plugin generate` (with `-t APIPlugin`) emits an attacker-controlled `static_template.file` path from the AI-plugin extensions (`x-ai-adaptive-card`, `x-ai-capabilities`) **verbatim**, with no path validation, into the generated Microsoft 365 Copilot / Teams p…
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
`next-auth` (Auth.js) v5 applications that gate access by checking only for the **existence** of the `auth` object — the pattern shown in the official [session management / protecting resources guide](https://authjs.dev/getting-started/session-management/protecting) — are affected.
…
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
The default email-address normalizer used by the email/magic-link sign-in flow validates the address **before** applying Unicode normalization. An address can contain a Unicode character that is not an ASCII `@` (U+0040) but canonicalizes to one under NFKC/NFKD normalization (the normali…
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
The vulnerable function is this one:
https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth_token.go#L33-L6…
LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
When LightRAG is deployed with `LIGHTRAG_API_KEY` set but `AUTH_ACCOUNTS` unset (an officially documented "API-Key authentication" mode), the `X-API-Key` protection can be bypassed by any remote unauthenticated attacker. The bypass does not require network contact with the victim server …
CVE-2024-58355
CVE-2024-58353
Gitea: Permanent Fork PR Workflow Approval Gate Bypass
|——-|——-|
| **Identifier (researcher-assigned)** | GITEA-2026-004 |
| **Product** | Gitea (self-hosted Git service) |
| **Component** | Gitea Actions — fork pull request approval gate |
| **Affected versions** | All Gitea releases **`v1.20.0` and later**, including the la…
CVE-2026-64467
rust_binder: use a u64 stride when cleaning up the offsets array
Allocation's Drop walks the offsets array (binder_size_t = u64 entries),
cleaning up the objects, but it used usize instead of u64 for both the
stride and the per-en…
CVE-2026-64394
ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a
permission check for FSCTL_SET_SPARSE") added a fp->daccess gate to
fsctl_set_sparse and noted…
Budibase: Privilege escalation via public role assignment API missing app-level authorization
Budibase `3.39.19` (commit `03fbabae4`) is affected by a privilege-escalation / missing-authorization flaw in the public role-assignment API. An **app-scoped builder** (a user who builds only specific apps — `user.builder.apps = [appA]`, not a global builder or admin) can grant **them…
GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
GitPython's `check_unsafe_options` guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since) can be bypassed for **every** guarded method (`clone`/`clone_from`, `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`) by smuggling an option token insid…
Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)
`ray.data.read_webdataset(paths=…)` is a `@PublicAPI(stability="alpha")`
reader for WebDataset-format TAR files. Its default `decoder=True` invokes
`_default_decoder` on every sample's keys, which routes file extension to a
decoder by extension. Two of those branches deserialize attack…
CVE-2026-16745
CVE-2025-44089
CVE-2026-16423
CVE-2026-16421
CVE-2026-16420
CVE-2026-16418
CVE-2026-60400
CVE-2026-60398
CVE-2026-60157
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write
| Field | Value |
| ——————- | ———————————————————————————– |
| Vulnerability Title | Cached Per-Branch Permission Ch…
GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
**Component:** gitpython-developers/GitPython (PyPI: GitPython)
**Affected:** all versions carrying the 3.1.47 blocklist fix, through current `main` (ve…
CVE-2026-55084
`/api/sqlViews/{viewId}/data.json` endpoint. An authen…
Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core Negotiate Authentication (Microsoft.AspNetCore.Authentication.Negotiate). This advisory also provides guidance on what developers can do to update their applications to re…
Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core Negotiate Authentication (Microsoft.AspNetCore.Authentication.Negotiate). This advisory also provides guidance on what developers can do to update their applications to re…
CVE-2026-15904
CVE-2026-15903
CVE-2026-15902
CVE-2026-12341
impacts all versions of IdentityIQ and allows an unauthenticated attacker
unauthorized access to protected APIs and data due to improper validation of
OAuth bearer tokens.
CVE-2026-64206
Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
l2cap_conn_del() takes conn->lock and then calls cancel_work_sync() for
pending_rx_work. process_pending_rx() takes the same mutex, so teardown
can deadlock agains…
CVE-2026-25039
CVE-2026-65908
Budibase: SSRF via DNS rebinding in the REST datasource integration
Budibase's central outbound-fetch guard (`fetchWithBlacklist`) prevents SSRF/DNS-rebinding by resolving the target hostname, checking every resolved IP against the blacklist, and **pinning** the connection to the validated IP. The pin is implemented as a Node `http(s).Agent` (`makePinned…
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
A builder-level user can make Budibase issue server-side HTTP requests to loopback or private-network targets by using DNS rebinding against two outbound fetch paths that are still not pinned to the validated DNS answer.
The first path is OpenAPI query import. It validates the supplied h…
CVE-2026-17107
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
## Summary
Gitea validates the user-supplied repository migration URL, but the actual clone and later mirror fetch operations are performed by the Git command-line clie…
CVE-2026-64806
GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
GitPython spawns the real `git` binary with an argument vector built from caller-supplied values. To prevent argument injection, GitPython maintains denylists of "unsafe" Git options (`–upload-pack`, `–receive-pack`, `–exec`, `-c`, `–config`, …) that can be abused to run arbitrary …
CVE-2026-64824
CVE-2026-28220
CVE-2026-17497
Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution
Budibase's MongoDB query execution endpoint (`POST /api/v2/queries/:queryId`) is vulnerable to NoSQL injection through user-supplied query parameters. The `enrichContext()` function interpolates parameter values into JSON query templates using Handlebars with `noEscaping: true`, then par…
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
You are affected if all of the following hold:
– You run a `better-auth` version below 1.6.22, or a `1.7.0-beta` below `1.7.0-beta.10`.
– You enable the magic-link plugin or the email-OTP plugin.
– You also enable email and password sign-up with open registration.
– An account ca…
CVE-2026-16416
CVE-2026-16413
CVE-2026-47688
Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Pillow's public rank-filter API can trigger a native heap out-of-bounds write
when given a very large odd filter size.
Minimal public API trigger:
“`python
from PIL import Image, ImageFilter
im = Image.new("L", (3, 3), 128)
im.filter(ImageFilter.MedianFilter(4294967295))
“`
`Image…
Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL (System.Net.Security). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A security feature bypass…
CVE-2026-47255
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
A scoped, non-admin File Browser user holding only the **Create** permission can delete arbitrary files outside their scope (other tenants' data, and the application's own database) via the upload failure-cleanup path. This is an incomplete fix of CVE-2026-54094: the v2.63.14 `ScopedFs` …
CVE-2026-54342
GitPython: Arbitrary file overwrite via git diff –output argument injection in Diffable.diff (key- and value-controlled)
`Diffable.diff()` forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options` guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`, giving a broad surface. `git diff –output=<path>` writes real patch content to an attacker-chosen path…
CVE-2026-64235
x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines
With CONFIG_CALL_DEPTH_TRACKING enabled on an x86 retbleed-affected platform
(eg: Skylake), with retbleed=stuff, registering a dynamic ftrace trampoline
crashes…
CVE-2026-64223
wifi: mac80211: consume only present negotiated TTLM maps
ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements
against the number of link-map entries indicated by link_map_presence.
ieee80211_parse_neg_ttlm() mus…
CVE-2026-61106
Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
Gitea's OAuth2 sign-in callback reactivates a deactivated user account (`IsActive=false`) when the user signs in through an authentication source that does not issue refresh tokens (notably GitHub, and any OIDC/OAuth2 source configured without `offline_access`). PR #38009 added a gat…
Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Gitea does not re-evaluate the `official` flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access to a repository can obtain an `official: true` approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch …
Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A sec…
File Browser: Colliding username normalization gives two users the same home directory
FileBrowser confines each user to a *scope*: a home directory that acts as the boundary for everything they can read or write. When self-registration and automatic home-directory creation are both enabled (`Signup=true` and `CreateUserDir=true`), a new user's scope is built from their us…
Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
The terminal proxy in `backend/open_webui/routers/terminals.py` forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is attacker-influ…
CVE-2026-61224
CVE-2026-47237
CVE-2026-64418
mm: shrinker: fix shrinker_info teardown race with expansion
expand_shrinker_info() iterates all visible memcgs under shrinker_mutex,
including memcgs that have not finished ->css_online() yet.
Once pn->shrinker_info has been pub…
CVE-2026-64361
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
check_and_correct_requested_length() compares (off + len) against
node_size using u32 arithmetic. When the caller passes a large len
value (e.g. from an underflo…
CVE-2026-64293
iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
The bound-check in iommufd_veventq_fops_read() for the normal vEVENT
path uses sizeof(hdr) where the surrounding code uses sizeof(*hdr):
if (!vevent_for_lost_event…
CVE-2026-64277
Input: synaptics-rmi4 – bound the F3A keymap to the GPIO count
rmi_f3a_initialize() takes the GPIO count from the device query register
(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).
rmi_f3a_map_gpios() then allocates…
Oh My Posh: Arbitrary command execution via template injection in the path segment
Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go `text/template` engine. That engine's function map exposes a `cmd` function that runs arbitrary OS commands. A directory whose name contains a Go template express…
CVE-2025-71408
CVE-2026-64226
sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error()
dereferences p->comm and p->pid. If the iterator's reference is the last
drop, the tas…
CVE-2026-64221
spi: ti-qspi: fix use-after-free after DMA setup failure
The driver falls back to PIO mode if DMA setup fails during probe.
Make sure to clear the DMA channel pointer also if buffer allocation
fails to avoid passing a pointer to …
CVE-2026-64218
batman-adv: bla: fix report_work leak on backbone_gw purge
batadv_bla_purge_backbone_gw() removes stale backbone gateway entries,
but fails to properly handle their associated report_work:
– If report_work is running, the purge m…
CVE-2026-64217
netfs: Fix overrun check in netfs_extract_user_iter()
Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills
pages[], then those pages don't get included in the iterator constructed at
the end of the function.…
electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
`AppImage` targets built by `app-builder-lib` could use an empty path component when setting the `LD_LIBRARY_PATH` environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary c…
CVE-2026-64802
CVE-2026-64600
xfs: resample the data fork mapping after cycling ILOCK
xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,
a data fork mapping, and a cow fork mapping. Unfortunately, these two
helpers cycle the ILOCK to grab …
CVE-2026-16607
CVE-2026-16414
CVE-2026-60570
CVE-2026-47054
Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
An elevation of privil…
CVE-2026-15905
CVE-2026-64191
i2c: stub: Reject I2C block transfers with invalid length
The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]
as the transfer length. The existing check only clamps it to avoid
overrunning the chip->words[256] reg…
CVE-2026-64189
netfilter: ipset: fix race between dump and ip_set_list resize
The release path of ip_set_dump_do() and ip_set_dump_done() read
inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw()
of the array pointer. These …
CVE-2026-64188
net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
rmnet_dellink() removes the endpoint from the hash table with
hlist_del_init_rcu() and then immediately frees it with kfree(). However,
RCU readers on the receiv…
Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)
The Budibase AI chat-link handoff flow (`GET/POST /api/chat-links/:instance/:token/handoff`) binds an **external chat identity** (Slack/Discord/MS Teams/Telegram) to a **Budibase user account**. The confirmation endpoint is on a **public route** (no CSRF middleware, no auth-group gate) …
Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs
In Budibase v3.39.4, a regression in the authorization level for the S3 attachment upload endpoint allows any BASIC app user to obtain S3 PutObject presigned URLs. The endpoint uses TABLE/WRITE permission level instead of the intended BUILDER level defined in v3.39.3. Additionally, the co…
open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
## Summary
The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. `backend/open_webui/routers/terminals.py` documents `_sanitize_proxy_path()` as decoding until stable, but the implementation stops after 8 …
Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside **another** user's authenticated session. The Socket.IO event-caller (`get_event_call`) delivers `execute:python` / `execute:tool` events to a **client-supplied** `session_id` after only ch…
Gitea: Two SSRF findings
| Versions tested | `gitea/gitea:1.26.2` (digest `sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031`); `gitea/gitea:latest` resolves to the same digest at time of writing |
| Source review | `git checkout v1.26.2` (commit `2c749ce`) |
| Reproduction | `bash run_po…
Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository.
### Detail…
CVE-2026-46555
CVE-2026-54910
OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
The `/api/fs/batch_rename` handler validates and authorizes only the requested source directory. It rejects path separators in `new_name`, but it does not validate `src_name`. The handler concatenates `src_dir` and attacker-controlled `src_name`, then passes the result to the filesystem…
Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
**This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p
(PostgreSQL SQL injection), reported in the same original disclosure and
split per GitHub CNA guidance (rule 4.2.11) since it affects a separate
integration, has a distinct attack precondition, and require…
Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim
Cloudreve's OAuth access tokens can bypass OAuth scope enforcement.
This does not appear to be the intended design. The documentation describes OAuth client permissions/scopes, the API
has an insufficient-scope error code, and the code comments say `RequiredScopes(…)` should ver…
CVE-2026-63720
Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists where, under certain circumstances, allocation of resources without limits…
libp2p: yamux connection DoS via oversized data frame
The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop…
OmniFaces: Forged combined-resource IDs and related output/push boundaries
`CombinedResourceInfo` accepts a path-derived ID without an authenticity check,
inflates it without an output limit, converts it to attacker-selected resource
identifiers, and retains unique IDs in an unbounded static cache. In bounded
tests, 20,754 encoded bytes i…
blaze: Unbounded WebSocket message aggregation in http4s-blaze-server
`http4s-blaze-server` aggregates the fragments of an incoming WebSocket
message with no limit on total size or fragment count. A client that
completes a WebSocket handshake can send an unterminated fragmented
message and drive unbounded heap growth in the server JVM, resulting in
denial …
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
`expand()` bounds the *number* of results it produces (the `max` option,
`100_000` by default) but not their *length*. By chaining many brace groups,
an attacker keeps the result count under `max` while making every result grow
with the number of groups. Building `max` long results — …
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
`@anephenix/hub` starts a `setInterval` polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never replies — which requires no authentication or special configuration — the interval and the pending request object are never cleaned…
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
The fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573) stopped `Repo.clone_from()` from running caller-supplied URLs through `os.path.expandvars()`, but it guarded only that one caller. `Remote.create()` — reached fr…
Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
The Budibase Worker service exposes a public, unauthenticated API endpoint (`GET /api/global/users/tenant/:id`) that returns sensitive user information including `tenantId`, `userId`, `email`, and `ssoId`. The endpoint is registered in the `PUBLIC_ENDPOINTS` list with a `TODO` comment a…
react-server-dom: Denial of Service in Server Functions
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.
We recommend updating immediately.
The vulnerability exists in versions 19.0.0 through 19.0.…
yt-dlp: Downstream command injection via improper sanitization of yt-dlp –write-link output
If the `–write-link`, `–write-url-link` or `–write-desktop-link` options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the `.url` and `.desktop…
CVE-2026-66033
Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
An attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated `</` characters) to a Netty server utilizing XmlFrameDecoder, causing the server's EventLoop thread to exhaust CPU resources and become unresponsive.
### Details
`io.netty.handle…
js-yaml: Exponential parsing time in flow collections leads to denial of service
Parsing a small YAML document can take exponential time. An application that calls `load()` or `loadAll()` on untrusted input can be hung by a payload under 200 bytes.
### Details
When an entry in a flow sequence turns out to be a `key: value` pair, the parser rewinds and parses that en…
@fastify/static vulnerable to route guard bypass via path traversal
`@fastify/static` is vulnerable to a bypass of route-based middleware and guards via non-leading `..` and `%2E%2E` path segments. `find-my-way` does not normalize `..` when matching routes, so a request such as `/foo/../deep/secret.txt` matches the static plugin's catch-all instead of th…
GitPython: Incomplete unsafe_git_clone_options denylist omits –template enabling arbitrary command execution via clone hooks
GitPython's `unsafe_git_clone_options` denylist omits `–template`. `git clone –template=<dir>` copies `<dir>/hooks/` into the new repository and runs them (`post-checkout` fires during clone), so a caller who can influence clone options can achieve arbitrary command execution in the def…
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
**File**: `lib/previous-map.js`
**Line**: 87-98 (`loadFile`), 129-144 (`loadMap`)
### Root Cause
PostCSS auto-detects a `/*# sourceMappingURL=… */` comment inside the CSS text it is asked to parse and, unless the caller explicitly passes `map: false`, attempts to load t…
CVE-2026-64210
net/mlx5e: xsk: Fix unlocked writing to ICOSQ
During napi poll, when the affinity changes and there's still XSK work
to be done, we trigger an ICOSQ interrupt on the new CPU. However, this
triggering on the ICOSQ is done unprotect…
CVE-2026-64208
crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks
Change the krb5 crypto library to provide facilities to precheck the length
of the message about to be decrypted or verified.
Fix AF_RXRPC to make use of this t…
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
The Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled e…
Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
# Impact
The Kiota Ruby code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI default fields and property names directly into Ruby doubl…
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
The `httplib2` HTTP client library performs unbounded decompression of HTTP response bodies encoded with `Content-Encoding: gzip` or `deflate`. A malicious or compromised HTTP server can return a small compressed payload (approximately 150 KB) that expands to an arbitrarily large size i…
Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
The `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragm…
find-my-way: DDoS with HTTP2
Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.
The short version is that `lookup()` passes `req.method` into `find()`, and `find()` indexes `this.trees[method]`. Since `this.trees` is a normal object, HTTP/2 method values like constructor, `toString`, …
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
PostCSS's `PreviousMap` parses the `/*# sourceMappingURL=PATH */` comment from any CSS string passed to `process()` and dereferences `PATH` against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to rea…
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
The exported `getToken()` helper (`next-auth/jwt` and `@auth/core/jwt`) can throw an uncaught exception when it reads a malformed `Authorization: Bearer …` header. When no session cookie is present, `getToken()` URL-decodes the bearer value before validating it, and malformed percent-e…
CVE-2026-14257
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
The original report:
> Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.
After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer.
This is p…
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
Netty's Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the specified payload length without any limits. The payload length is read directly from the wire and trusted without validation. A bad actor can send a reserved frame with a payload length of up to Inte…
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has already exceeded maxHeaderSize and marked the frame truncated. At commit b2d2137c4404af425bf9d5d601a62576f5c06925, a 12,253-byte compressed SPDY header block can declare and infla…
Netty SPDY SETTINGS frame count materializes unbounded settings map
Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame` without an implementation-level count cap. A remote SPDY/3.1 peer can send one syntactically valid roughly…
CVE-2026-16422
CVE-2026-65315
GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
`Repo.clone_from()` passes the caller-supplied remote URL through `Git.polish_url()`, which on every non-Cygwin platform calls `os.path.expandvars()` on the URL before handing it to `git clone`. An attacker who controls the URL argument — the documented use case for `clone_from()` in "…
Gitea: Notification API leaks private issue metadata after access revocation
An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation,…
Gitea: Unauthorized Access to Labels of Private Organizations
Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpoints.
A user without access to a private organization can retrieve labels belonging to that organization through the Organization Labels API. As a result, label metadata intended …
Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private
The `POST /api/v1/repos/{owner}/{repo}/merge-upstream` endpoint continues to synchronize commits from a parent repository after the parent repository has been changed from public to private.
A fork created while the parent repository was public can still receive commits made after the …
Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override
Gitea's internal API HTTP client (modules/private/internal.go) hardcodes
TLSClientConfig.InsecureSkipVerify = true with no configuration override. It is the only
outbound TLS client in the codebase that cannot be made to verify its peer's certificate —
webhook, migrations, MinIO, LDAP, SM…
Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
Gitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to wr…
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
The univ.Real type converted its (mantissa, base, exponent) value to a Python float using exact big-integer exponentiation. A BER/CER/DER-encoded REAL value only a few bytes long can carry a very large exponent, causing this computation to attempt to materialize an astronomically large in…
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
The BER/CER/DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload (tens of kilobytes) containing an OID with many arcs consumes seconds of CPU per decode() call, allowing denial of service in any applicatio…
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input s…
CVE-2026-44907
Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core SignalR (Microsoft.AspNetCore.App.Runtime). This advisory also provides guidance on …
Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A den…
Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
Pillow's public `ImageCms.ImageCmsTransform.apply(im, imOut)` API can trigger
controlled native heap corruption when the caller supplies an output image whose
mode does not match the transform's declared output mode.
For example, a transform built as `RGBA -> RGBA` can be applied to an…
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
`PdfParser.PdfStream.decode()` in Pillow's `PdfParser.py` calls `zlib.decompress()` with the `bufsize` parameter set to the value of the PDF stream's `Length` field, without any upper bound on the actual decompressed output size. Python's `zlib.decompress()` `bufsize` argument is an *ini…
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
Pillow's public image coordinate APIs can trigger a native heap out-of-bounds
write when given coordinates near the signed 32-bit integer limits. In 4-byte
pixel modes such as `RGBA`, this becomes a controlled backward heap underwrite:
for a source image of width `W`, Pillow writes `4 *…
Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET HTTP client (System.Net.Http). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A denial of service vulne…
Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A den…
Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A den…
Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL (System.Net.Security). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A denial of service vulne…
Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML processing (System.Security.Cryptography.Xml, System.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerabi…
Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET runtime cryptography layer (CryptoNative_GetX509NameInfo). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerabi…
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
**Type:** Algorithmic-complexity denial of service. A run of N closed pairs `~~x~~~~x~~…` (or the analogous `==x==` for `mark`, `^^x^^` for `insert`) causes O(N²) work in the formatting parser. With the `strikethrough`, `mark`, or `insert` plugin enabled, an 8 KB input pegs the CPU fo…
Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
**Type:** Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed `**x**` (strong) or `***x***` (strong-emphasis combined) pairs causes O(N²) parser work. Distinct from the bracket-bomb DoS (`[` repetition) and from the formatting-plugin DoS (`~~`/`==`/`^^`);…
Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
**Type:** Algorithmic-complexity DoS in reference-link definition handling. A markdown document with N reference-link definitions of the same key (or many distinct keys) takes O(N²) parser time. 5000 repeated `[a]: u\n` definitions take ~1.1 second; 10000 → ~4.5 seconds.
**File:** `sr…
Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
`PIL/GdImageFile.py` `GdImageFile._open()` reads image dimensions from the GD 2.x header and stores them in `self._size` without calling `Image._decompression_bomb_check()`. Because `GdImageFile` is **not registered with `Image.register_open()`**, it never passes through the standard…
Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
`PIL/BdfFontFile.py` `bdf_char()` (lines 84–88) reads the `BBX width height` field from a BDF font file and passes the dimensions directly to `Image.new()` without calling `Image._decompression_bomb_check()`. This completely bypasses Pillow's documented decompression bomb protection.
…
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
`PIL/FontFile.py` `FontFile.compile()` assembles per-glyph images into a single combined bitmap using `Image.new("1", (xsize, ysize))` without calling `Image._decompression_bomb_check()`. This is the base-class method shared by both `BdfFontFile` and `PcfFontFile`, and it is triggere…
Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
`PIL/PcfFontFile.py` `_load_bitmaps()` (line 227) reads glyph dimensions from the PCF `METRICS` section and passes them directly to `Image.frombytes()` without calling `Image._decompression_bomb_check()`. Dimensions originate from unsigned 16-bit values:
“`
xsize = right – left …
Tornado: Quadratic DoS via Crafted Multipart Parameters
The `_parseparam` function in Tornado's `httputil.py` is used to parse specific HTTP header values, such as those in `multipart/form-data`. This function uses an inefficient algorithm that repeatedly calls `string.count()` within a nested loop while processing quoted semicolons (e.g., `p…
Tornado: Quadratic DoS via Repeated Header Coalescing
The `HTTPHeaders.add` method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity.
Given Tornado's single event loop architectur…
CVE-2026-45713
blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
blaze-server can merge HTTP/1.1 chunked-body trailer fields into `Request.headers`. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values (e.g. `X-Forwarded-For`, internal-auth headers) that a fronting proxy sanitized …
blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser (`http/src/main/java/org/http4s/blaze/http/parser/`) cause request-boundary disagreement with a stricter intermediary. All are reachable from a default `BlazeServerBuilder` with no non-default configurat…
Netty: TOCTOU in OcspServerCertificateValidator
Netty's OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data (e.g., HTTP requests) to a revoked server before the channel is closed by the…
Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
`OcspServerCertificateValidator` flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as `VALID`, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate.
### Details
In `io…
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
Netty's OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID. A bad actor can replay a `GOOD` status response issued for an unrelated certificate (by the same CA) to bypass revocation checks for any certificate.
### Details
`io.nett…
AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()
The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in…
Open WebUI: Stored web worker XSS via Pyodide
### Summary
Open WebUI runs client-side Python (Pyodide) in a same-origin web worker. Through Pyodide's JavaScript API (`pyodide.http.pyfetch`, or the `js` module which exposes the page's `fetch` / `XMLHttpReque…
CVE-2026-16796
To mitigate this issue, u…
CVE-2026-56624
Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or …
CVE-2026-32825
CVE-2026-16247
the application LogPathConfig.exe is executed during setup. During this
process, existing permissions on %ProgramData% are deleted and replaced,
granting the Windows group Everyone full control instead of restricting
access to %ProgramData%\Bizerba\_connect.…
CVE-2026-16246
application LogPathConfig.exe is executed during setup. As a result, the
Windows group Everyone is granted full control over %ProgramData% instead of
being restricted to %ProgramData%\Bizerba\BRAIN2\.
Starting with BRAIN2 3.09, the setup no
longer executes …
CVE-2026-65693
CVE-2026-66138
CVE-2026-60396
Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like `{"email": "{{ currentUser.email }}"}` so each app user only sees their own rows. Because the binding …
Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials
Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer token scoped to `Admin.Read` but not `Admin.Write` can call `POST /api/v4/admin/policy/oauth/signin` and update OneDrive storage policy credentials.
The route is inside the admin…
Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
Any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a `channel:`-prefixed `chat_id` and a target `message_id`. The `channel:` path routes pipeline output through `_m…
Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
With Redis configured, Open WebUI supports JWT revocation: `POST /api/v1/auths/signout` (per-token `jti`) and OIDC back-channel logout (per-user `revoked_at`) record revocations in Redis, and HTTP auth (`get_current_user`) rejects revoked tokens with 401. The realtime authentication surf…
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Microsoft Kiota resolved OpenAPI `$ref`s by fetching remote `http(s)` URLs and reading local files
(including absolute / out-of-tree paths), inlining the referenced schema into the generated client.
Running `kiota generate` on a spec whose `$ref` pointed at an attacker/internal URL or an…
@better-auth/stripe: cross-organization billing tampering in organization subscription actions
You are affected if all of these are true:
– You use `@better-auth/stripe` from version 1.4.11 up to a patched version below. This covers the stable line through 1.6.20 and every 1.7.0 beta through 1.7.0-beta.9.
– The Stripe plugin has subscriptions turned on (`subscription.enab…
CVE-2026-57767
Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
I'm reporting **two related TOTP one-time-use defects** in Gitea that survive the CVE-2021-45331 fix. The 2018 fix (PR #3878) introduced the `TwoFactor.LastUsedPasscode` field and added an in-memory inequality check on the web 2FA login path. That check works correctly in the single-req…
Gitea: Repository Visibility Manipulation via Git Push Options
| Field | Value |
|——-|——-|
| **Affected File** | `routers/private/hook_post_receive.go` |
| **Affected Function** | `HookPostReceive()` |
| **Affected Lines** | 173–225 |
| **Prerequisite** | Attacker must have owner-level or ad…
Gitea: Git LFS object reuse allows non-Code access to authorize private source objects
A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object.
The issue appears to be …
CVE-2026-21575
This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impa…
CVE-2026-56623
A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories …
AWS API MCP Server Security Policy Bypass via Startup Initialization Failure
The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It provides programmatic access to manage your AWS infrastructure while maintaining proper security controls. It in…
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
In GitPython `<= 3.1.52`, the config writer neutralizes only CR, LF, and NUL in configuration **names**, but writes section names into the `[…]` header with no other escaping. A section/subsection name that contains `] [ "` closes the intended header and opens a second same-line secti…
CVE-2026-64222
octeontx2-pf: avoid double free of pool->stack on AQ init failure
otx2_pool_aq_init() frees pool->stack when mailbox sync or retry
allocation fails, but leaves the pointer unchanged. Later,
otx2_sq_aura_pool_init() unwinds the par…
CVE-2026-64219
drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async
[Why&How]
dc_process_dmub_aux_transfer_async() copies payload->length bytes into a
16-byte stack buffer (dpaux.data[16]) guarded only by…
Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SDK (Microsoft.NET.Build.Containers). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A tampering vulner…
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
_What kind of vulnerability is it? Who is impacted?_
A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and e…
etcd: Watch API authorization bypass via open-ended range requests
_What kind of vulnerability is it? Who is impacted?_
A user granted READ permission on a single, exact key can use the Watch gRPC API with `clientv3.WithFromKey()` (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically gr…
Shescape: Quadratic-time denial of service in the flag-protection
This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used.
An attacker can cause a runtime quadratic in the input size, causing denial of service for large inputs.
“`javascript
import { Shescape } from "shescape";
// 1.…
vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review
Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes.
Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review
### Patches
No
### Workarounds
No
frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow
An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire `frps` process with a single five-byte message. When the gateway parses an SSH `exec` channel request in `pkg/ssh/server.go`, it adds a small consta…
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
When creating a MongoDB datasource, Budibase passes the `tlsCertificateKeyFile` and `tlsCAFile` fields straight to the MongoDB driver as server-side file paths. On Budibase Cloud a customer cannot place files on the server, so these fields only let a builder reference arbitrary absolute p…
Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
`POST /api/v2/email` on the account portal (`account.budibase.app`) starts an email-change workflow using a client-supplied `accountId` that is **not validated against the authenticated session**. A logged-in attacker supplies a victim's `accountId` and an email address they control; the…
Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
> [!NOTE]
> This only affects your application if you are using the unstable RSC APIs
Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Microsoft Kiota emitted the `x-ms-kiota-info` extension's `clientClassName` or `clientNamespaceName` value
**raw**, with no identifier or path sanitization, as **both** the generated client's class/namespace name
**and** part of the generated output path. When `kiota generate` is run **…
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Microsoft Kiota honors a poisoned `.kiota/workspace.json` — the workspace configuration that Kiota's
documented team workflow has developers commit to their repository — **unvalidated** on
`kiota client generate` / `kiota plugin generate`. A repository (or pull request) containing a…
Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator
The Kiota PHP code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI fields (e.g. `description`, default values, and property names) directly into PHP double-quoted string literals without properly escaping the `$` charac…
Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
Kiota versions **prior to 1.32.3** are affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the `description`, `externalDocs` label, and `externalDocs` link fields emitted as `/// …` comments).
When text from an OpenAPI description is writte…
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
**CWE**: CWE-770 (Allocation of Resources Without Limits or Throttling) — sibling class of GHSA-8xx9-69p8-7jp3 and GHSA-2546-xv4c-mc8g, applied to `memoryLimit` instead of `renderLimit`
## Summary
The `pop` …
electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
In `electron-builder`'s `builder-util-runtime` package, the HTTP redirect handler (`HttpExecutor.prepareRedirectUrlOptions`) only stripped a credential header whose key string matched exactly lowercase `"authorization"`. Other credential-bearing headers — most notably `PRIVATE-TOKEN` (…
pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters.
### Patche…
pypdf: Possible infinite loop for not terminated inline images
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example.
### Patches
This has been fixed in [pypdf==6.14.1](https://…
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
Certain notebook display settings were not properly validated before being applied. As a result, a crafted settings file could contain hidden instruct…
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
### Impact
This vulnerability allows for ar…
Next.js: Server-Side Request Forgery in Server Actions on custom servers
When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to ob…
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response fr…
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Crafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry in `config.i18n.locales` can bypass middleware/proxy based authentication.
## Workarounds
If you cannot upgrade immediately, enforce authorization in the page's server-side data …
Next.js: Denial of Service in App Router using Server Actions
Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.
## Workarounds
No workaround exists besides upgrading. Applications using Pages Router or not usi…
Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
The `DigestAuthentication.apply()` method in Jetty's HTTP client uses `getBytes(StandardCharsets.ISO_8859_1)` at three locations (lines 171, 179, 196) to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF (Chinese, Japanese, Cyrillic, Arabic, Emo…
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.
The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key va…
n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service
The Edit Fields (Set) node assigned output fields through a dot-notation path setter without restricting the field name, so an authenticated user could name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global was use…
n8n: Edit Image Node Format Injection Allows Arbitrary File Write
The n8n Edit Image node passed its output format to the underlying image library without validation, so a crafted value could write bytes to a location outside the node's working directory. An authenticated user able to run workflows could use this to write arbitrary files in the n8n inst…
n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with editor access to a shared workflow could reference a credential they were not permitted to use inside that inl…
n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`
An authenticated member with edit access to a shared workflow could reference another user's credential in an HTTP Request node while specifying the credential type through an expression. Because the pre-execution permission check compared the unresolved expression instead of the real cre…
n8n: Expression sandbox escape via arrow-function bodies enabling command execution
An authenticated user with permission to create or modify workflows could abuse crafted expressions using arrow functions to bypass the expression sandbox, triggering unintended system command execution on the host running n8n.
## Patches
The issue has been fixed in n8n versions 2.31.5 …
n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
The n8n Send Email node did not enforce that its message fields were strings, so a crafted untrusted non-string value from a workflow expression could be treated by the underlying mail library as a file path or URL. This could allow disclosure of local files on the n8n host.
Exploitation…
n8n: Authenticated code execution in the n8n Git node
Authenticated n8n users with rights to create and execute workflows could achieve code execution on the n8n host. Using the Git node, under the default `git` security settings, by staging a crafted local repository, an attacker could cause `git` to run hooks, executing arbitrary commands …
n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction
Authenticated n8n users with workflow create/execute rights could use the Git node's fetch, pull, or push-tags operations to bypass the repository-path containment checks that already protected clone and push. By pointing an allowlisted remote configuration value at a local path outside t…
n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes
The credential "Allowed HTTP Request Domains" allowlist was intended to restrict which hosts a credential's secret could be sent to, protecting shared credentials from users who could use but not view them. Several AI/LLM nodes did not enforce this allowlist when a user-supplied base or e…
n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
In an n8n instance, when a validly-signed incoming token was matched to a local account by its email claim, the service did not check that the trusted key's permitted role ceiling covered that account, nor that the email claim was verified. As a result, anyone able to obtain a token accep…
n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
n8n's Enterprise SSO instance-role provisioning maps a role claim asserted by the configured Identity Provider (IdP) to an n8n global role and applies it during authentication. The provisioning path did not prevent assignment of the `global:owner` role, unlike the token-exchange identity p…
n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
The legacy expression evaluator's computed-member sanitizer can be bypassed by an authenticated user with workflow create or modify permissions. Successful exploitation grants the attacker host-level code execution as the n8n process.
The legacy expression engine is the default engine in …
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
– Authorization Bypass (Fail-Open) when transla…
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq) (Number Length Constraint Bypass in Async Parser, published 2026-02-28) is incomplete. The fix commit `b0c428e6` (#1555) wir…
Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated `Disable Account` action and issuing a fresh authenticated session …
Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
The Locale middleware that runs in front of every unauthenticated request
calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw
`Accept-Language` header without imposing a size or shape filter. The
underlying parser has quadratic-time behaviour on long lists of malformed
lan…
Gitea: Privilege Escalation via Access Token Scope Escalation in API
Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
GitPython unsafe clone option gate bypass through joined short options
Git itself…
websocket-driver-ruby: Denial of service via malformed Host header
If this library is used to implement a WebSocket server on top of a TCP server, by using the `WebSocket::Driver.server()` method, then a client can cause the server to crash by sending a `Host` header that is not a valid `host[:port]` string. When this happens, a `URI::InvalidURIError` e…
PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms
`channelBinding=require` connections can be silently downgraded from `SCRAM-SHA-256-PLUS` (with channel binding) to plain `SCRAM-SHA-256` (without it), losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the…
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
`src/libImaging/Jpeg2KDecode.c:853` accumulates `total_component_width` across every tile in a JPEG2000 image instead of recomputing it per tile. That accumulated value is then used in the `tile_bytes` calculation at `src/libImaging/Jpeg2KDecode.c:868`, which can make the decoder grow `s…
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
When Pillow loads an uncompressed image whose tile uses the `raw` codec and a mode in `Image._MAPMODES`, and the image was opened **from a filename**, it memory-maps the file and builds the image's row pointers directly into the mapping via `PyImaging_MapBuffer` (`src/map.c`). The per-ro…
vLLM denial of service via prompt embeds on M-RoPE models
_Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._
Sending a pure prompt embeds payload in a `/v1/completions` request with a mod…
React Router: Open redirect leading to XSS
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Auth.js stores the OAuth/OIDC anti-CSRF checks (`state`, `nonce`, and the PKCE verifier) in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider,…
CVE-2026-16615
Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content
Gitea — `services/repository/collaboration.go` (`DeleteCollaboration`) + webhook delivery
## Summary
When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing
after the collaborator's access is revoked. Gitea's revocation cleanup …
File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
The fix for `GHSA-gxjx-7m74-hcq8` / `CVE-2026-54093` (shipped in v2.63.6) added a `strings.ReplaceAll(nameInArchive, "\\", "/")` step to the archive builder; this was the advisory's recommended "Primary Fix." On a Linux host a backslash is a legal, non-separator filename character, so re…
CVE-2026-60406
CVE-2026-63729
OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
An authorization bypass vulnerability exists in the file sharing mechanism of `Openlist`. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/u…
Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources
Kite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified by the original route parameters. Encoded path traversal segments can cause the upstream URL to resolve to a different Kubernetes API endpoint after authorization.
## Impact
An …
Cloudreve: Denial of Service – Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server
Cloudreve's built-in image processor decodes user-supplied images with Go's standard-library decoders (`image/png`, `image/jpeg`, `image/gif`) and guards **only the compressed file size** — never the *decoded* pixel dimensions. Go's decoders allocate a pixel buffer sized `bytesPerPixel…
Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
Two regexes in `backend/open_webui/utils/middleware.py` that parse `<$skillId|label>` skill-mention tags backtrack in O(n²) on input that contains `<$` followed by a long run with no closing `>`. Both run synchronously, on the asyncio event loop, on **every** chat completion with no feat…
Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
_What kind of vulnerability is it? Who is impacted?_
Prototype pollution in update casting: passing a user-controlled update to a Mongoose update, like `MyModel.updateOne(filter, req.body)`, can cause Mongoose to set `$fullPath` and `$parentSchemaDocArray` on `Object.prototype`.
Example…
LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges
Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods.
This affects applications where an attacker can influence …
CVE-2026-16798
Netty: STOMP CONNECT Frame Header Injection in Netty
## 1. Vulnerability Summary
| Field | Value |
|——-|——-|
| **Product** | Netty |
| **Version** | 4.2.12.Final (and all prior versions with codec-stomp) |
| **Component** | `io.netty.handler.codec.stomp.StompSubfr…
Netty: Security Control Bypass via CORS Short-Circuit Failure
Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection …
CVE-2026-9737
CVE-2026-13071
CVE-2026-13065
CVE-2026-13056
CVE-2026-13055
CVE-2026-13192
CVE-2026-63263
CVE-2026-63144
CVE-2026-60404
CVE-2026-60403
CVE-2026-60401
CVE-2026-60399
CVE-2026-10677
jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
`UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by iterating its properties and calling `prop.deserializeAndSet()` with **no `prop.visibleInView(ctxt.getActiveView())` guard** — the exact guard `processUnwrappedCreatorProperties()`…
Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
**Date:** 2026-05-24
**Target:** Gitea (self-hosted Git service)
**Branch tested:** `main` @ `b7e95cc48c` (development build, go1.26.3)
**Component:** `routers/api/v1/org/action.go` (org-level Actions API)
**OWASP:** API3:2023 Broken Object Property Level Authorization
–…
CVE-2026-63140
CVE-2026-63136
CVE-2026-46556
CVE-2026-16317
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
An unbounded `io.ReadAll(ctx.Req.Body)` call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory (OOM) kill. With con…
Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass
Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if **any** resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later `git…
Gitea: SSRF via HTTP Redirect in Repository Migration
Gitea 1.25.4 validates the initial URL provided to the repository migration endpoint (`POST /api/v1/repos/migrate`) and correctly blocks requests to internal addresses like `127.0.0.1` or RFC1918 ranges. However, if the initial URL points to an attacker-controlled server that responds wi…
Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
The web handler `EditReleasePost` (`routers/web/repo/release.go`) reads form fields with prefix `attachment-edit-{uuid}` into a `map[uuid]newName`, passes that map to `release_service.UpdateRelease`, which writes the new name to the database via `repo_model.UpdateAttachmentByUUID` WITHOU…
CVE-2026-56145
jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`
In `BeanDeserializer.deserializeUsingPropertyBasedWithExternalTypeId`, the active-view (`@JsonView`) filter was applied only to the regular bean-property branch; the creator-property branch performed no `creatorProp.visibleInView(activeView)` check. A constructor parameter annotated with…
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
For Java Records, `POJOPropertiesCollector._removeUnwantedIgnorals()` records a `@JsonIgnore`-annotated component under its original implicit name before `_renameUsing()` applies the `PropertyNamingStrategy`. After the rename, `_ignoredPropertyNames` still holds only the pre-rename name, …
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
Pillow's TGA RLE encoder reads past its row buffer when saving a mode `"1"`
image. Adjacent process heap bytes can be copied into the generated TGA file.
The bug is reachable through the public save API:
“`python
im.save(out, format="TGA", compression="tga_rle")
“`
Older affected P…
Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SMTP client (System.Net.Mail). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A spoofing vulnerability …
Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses
Cloudreve's remote download workflow accepts user-supplied URLs and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets.
When the remote download permission is granted to a non-admin user group, a normal authenti…
CVE-2026-63737
CVE-2026-61217
Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored
Cloudreve WOPI access tokens are generated as `<session-id>.<random-secret>`, but the WOPI middleware validates only the session id prefix and never compares the supplied token to the stored token. In addition, a WOPI viewer session does not store or enforce the requested viewer action. …
CVE-2026-13067
Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
`GetActionsUserRepoPermission` (`models/perm/access/repo_permission.go`) decides whether an Actions
task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator —
**except the collaborative-owner branch**, which is missing the `!task.IsForkPullRequ…
Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
Gitea's `restore-repo` CLI command restores a repository from a dump
directory/archive. When parsing `pull_request.yml` from that dump, the
`Head.CloneURL` field is used to add a git remote and fetch from it with
no validation, because the safety check that's supposed to guard it
(`Check…
CVE-2026-46403
File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
`ScopedFs` confines every File Browser user to a scope directory. Its `within()` guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead.…
Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
Oh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit metadata, environment variable values, command output) into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject…
OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
The OAuth2/OIDC consent page rendered for `display=wap` authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScrip…
ImageMagick: Policy Bypass in concatenate operation due to missing checks
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
CVE-2026-65901
CVE-2026-65900
setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
When building a source distribution (`python -m build –sdist` / `setup.py sdist`), setuptools' `FileList` applies `MANIFEST.in` directives (`exclude`, `global-exclude`, `recursive-exclude`, `prune`) by matching a compiled glob against on-disk file names **byte-for-byte, with no Unicode …
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
**Type:** URL-scheme allowlist gap. The `safe_url` filter only blocks the four schemes `javascript:`, `vbscript:`, `file:`, `data:`. Several other schemes are accepted into rendered `<a href="…">` and `<img src="…">` tags despite being known XSS vectors in legacy or chain-handling br…
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
An XSS vulnerability in Mistune allows bypassing of safe_url() protections via percent-encoded javascript URIs.
### Details
The vulnerability exists in HTMLRenderer.safe_url() in Mistune.
The function is intended to block harmful URL schemes such as "javascript:" by checking the prefi…
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
The OpenAPI adapter's spec-change **poller** (`OpenApiSpecPoller`) re-fetched the
configured spec `url` on a timer using a raw global `fetch()`, bypassing the SSRF
guard (`safeFetch` / `assertUrlSafe`) that `OpenAPIToolGenerator.fromURL()` applies
to the initial spec load. As a result, t…
CVE-2026-55990
CVE-2026-50046
CVE-2026-60266
CVE-2026-46968
Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content
Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue o…
Gitea: draft release attachment disclosure via missing web authorization
Gitea's draft-release access control is enforced only on the API release endpoints (`/api/v1/repos/{owner}/{repo}/releases/{id}` and its `/assets/…` sub-routes) but not on the web-level UUID-based attachment endpoints (`/attachments/{uuid}`, `/{owner}/{repo}/attachments/{uuid}`, `/{ow…
CVE-2026-59847
Mistune: Arbitrary File Read via Include directive path traversal
A path traversal issue exists in mistune's `Include` directive when markdown files are processed using `md.read()`. A crafted include path can cause files outside the intended markdown directory to be accessed.
### Details
The issue occurs in the `Include.parse()` method where user-su…
CVE-2026-45712
CVE-2026-63226
CVE-2026-61079
Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the automation test results. These results are broadcast via WebSocket to all builders connected to the same dev app and stored in an in-memory cache ac…
ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
## 1. Vulnerability Summary
| Field | Value |
|——-|——-|
| **Product** | Netty |
| **Version** | 4.2.12.Final (and all prior versions with codec-http multipart) |
| **Component** | `io.net…
CVE-2026-60409
Quasar: Prototype pollution in the extend() utility
`quasar@2.20.1`, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public `extend()` utility exported from the package root.
When `extend(true, target, source)` is used for a deep merge, attacker-controlled object keys are …
CVE-2026-60407
AWS CLI: Overly permissive File Permissions
The AWS Command Line Interface (AWS CLI) is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same h…
ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments
ImageMagick: Use-After-Free in crafted 8BIM when identifying an image
CVE-2026-54422
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
## 1. Vulnerability Summary
| Field | Value |
|——-|——-|
| **Product** | Netty |
| **Version** | 4.2.12.Final (and all prior versions with codec-haproxy) |
| **Component** | `io.netty.handler.co…
Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests
Cloudreve exposes two admin node test endpoints under the `Admin.Read` OAuth scope. These endpoints accept attacker-controlled node definitions and cause Cloudreve to make outbound server-side network requests. This allows an OAuth client authorized only for `Admin.Read` to trigger opera…
Open WebUI: Arena task endpoints can bypass underlying model access controls
An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as `/api/v1/tasks/moa/completions`.
The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selec…
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
Current `main` and `v0.9.6` still allow an authenticated user to turn read-only access to another user's file into write/delete access by attaching that file ID to an attacker-controlled workspace model.
This is an incomplete-fix variant of `GHSA-vjqm-6gcc-62cr`. The current fix adds `_…
CVE-2026-57530
CVE-2026-16415
Gitea LFS Deploy-Key Privilege Escalation
| Field | Value |
| ——————- | ———————————————————– |
| Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation |
| Severity Rating…
CVE-2026-47671
Tornado vulnerable to Header Injection and XSS via reason argument
## Summary
The `reason` argument (used by both `RequestHandler.set_status` and `tornado.web.HTTPError` is designed to allow applications to pass custom "reason" phrases (the "Not Found" in `HTTP/1.1 404 Not Found`) to the HTTP status line (mainly fo…
kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema
|—|—|
| Ecosystem | Go |
| Package | `github.com/getkin/kin-openapi` |
| Affected versions | `<= 0.143.0` (introduced in `v0.2.0`, PR #90, 2019-05-07; reproduced on `HEAD` `30e2923`) |
| Patched versions | 0.144.0 |
—
### Summary
`openapi3filter.ValidateRequest` contains a …
Budibase: Account Enumeration via Login Lockout Response Differential
The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticated attackers to enumerate valid email addresses. When an existing user's account is locked after 5 failed login attempts, the server returns a distinct `403` response with `X-Accou…
webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules
An attacker can cause excessive memory allocation in webtransport-go by sending an unknown WebTransport capsule with a large payload. The implementation skips unknown capsules by reading the entire capsule body into memory, instead of draining it without retaining the data. This can lead…
Open WebUI: Account enumeration via observable login timing discrepancy
The `/api/v1/auths/signin` endpoint leaked whether an email address belonged to a registered account through a response-time side channel. Password verification ran bcrypt only when the email was found in the database; for a non-existent email the request returned early without hashing.…
Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
A memory leak can be caused in Netty's DNS codec by sending malicious DNS packets containing invalid domain names. Because the leak occurs incrementally per packet, sustained malicious requests will cause a gradual Denial of Service.
### Details
Inside `io.netty.handler.codec.dns.Abstra…
Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
A malicious SSH server can crash a `russh` client session with a single
malformed key-exchange reply, causing a pre-authentication Denial-of-Service
before the server host key is verified. The embedding process itself stays
up, but the connection is killed deterministically.
### Details…
Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)
`c4be19f1915c8682f4615c3fd50008512b474491`, current default branch `main` as
of 2026-07-22). An unauthenticated client sends a single `SSH_MSG_KEX_ECDH_INIT`
whose `Q_C` is 32 zero bytes. russh's Curve25519 KEX does not reject th…
@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
`@fastify/static` evaluates the `allowedPath` callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as `//file`, `/./file`, or `/public/../private/file` bypass `allowedPath` filtering while resolving to the i…
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
`node-tar` (npm `tar`) contains an uncontrolled-recursion stack-exhaustion DoS in the internal `mapHas` helper used by `filesFilter`. When a consumer calls `tar.t(…)` or `tar.x(…)` with a non-empty member-selection list, node-tar installs a filter that closes over the recursive `mapHa…
PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
The `b64` extension inlines images referenced by `<img src="…">` as base64 data URIs. When resolving the `src` path it joins it onto the configured `base_path` with `os.path.normpath` and opens the result directly, with no check that the resolved path stays inside `base_path`. A `src`…
SvelteKit: Big remote form function payloads can cause Node process to crash
ImageMagick: Stack Overflow in MVG decoder due to missing depth check.
CVE-2026-12353
ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
CVE-2026-25466
Eclipse Jetty: Path parameter traversal
#### Summary
In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath() may leave dot-dot path segments unnormalized when a semicolon path parameter marker is followed by a slash and a dot
segment.
A minimal example is:
`/public;/../admin/secret`
In my local…
Eclipse Jetty: HTTP Authority/Host mismatch
Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular
Host header and the pseudo-header :authority
do not match. As a result, the same request can carry two different host identities
through Jetty:
– logic based on `HttpURI` / `Request.getServerName(request)` uses `:aut…
CVE-2026-13070
CVE-2026-50251
CVE-2026-60394
CVE-2026-46917
CVE-2026-16318
Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint
|——-|——-|
| **Affected File** | `routers/web/repo/githttp.go`, `services/context/repo.go` |
| **Affected Functions** | `httpBase()`, `EarlyResponseForGoGetMeta()` |
| **Affected Lines** | `githttp.go:63–66`, `services/context/repo.go:374–396` |
| **Prerequisite** | None…
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
Pillow's EPS parser (PIL/EpsImagePlugin.py) accepts a negative byte count in the %%BeginBinary directive. A crafted EPS file can cause Image.open() to seek backwards to the same directive and parse it repeatedly, resulting in an infinite loop and CPU denial of service.
The issue is tri…
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
**Type:** Uncontrolled recursion via mutual include. The `Include` directive checks for direct self-reference (`a.md` cannot include `a.md`), but does not detect indirect cycles. Two markdown files that include each other (`a.md` → includes `b.md` → includes `a.md`) cause unbounded r…
CVE-2026-55219
changedetection.io is vulnerable to unauthenticated static path traversal
The `/static/<group>/<filename>` route accepts `group=".."`, which causes `send_from_directory("static/..", filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling **unauthenticated local file read** of application source files (e.g., `flask_app.py`).…
CVE-2026-11804
This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Se…
ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds
ImageMagick: Heap Buffer Over-Write in fx operation
Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
The `/api/users/metadata` and `/api/users/metadata/:id` endpoints in `@budibase/server` return full global user profiles to any user with POWER role or above. For SSO-authenticated users (OIDC, Google), the response includes `oauth2.accessToken` and `oauth2.refreshToken` fields, leaking …
Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such tokens are limited to publi…
@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
The allowlist matching used by the experimental dynamic client registration and client ID metadata document (CIMD) features in `@backstage/plugin-auth-backend` matched glob patterns against the full URL string. A * wildcard could therefore match across URL component boundaries: a pattern …
ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided
ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219
ImageMagick: Infinite Loop in connected-components when providing invalid arguments
CVE-2026-65904
Loofah: SVG `href` attribute bypasses local-reference restriction
Loofah's HTML5 sanitizer restricted only the `xlink:href` attribute on certain SVG elements to local, same-document references. Browsers also accept a plain `href` attribute as an alternative to the deprecated `xlink:href` per the SVG 2 spec, but Loofah did not apply the same restriction…
Trix: Stored XSS via HTMLParser attribute injection on paste
The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The `HTMLParser` processed a mock attachment, a `<span>` carrying an empty `data-trix-attachment="{}"`. The empty attachment object caused the element to bypass attachment hand…
Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
`WindowsViewer.get_command()` constructs a `cmd.exe` shell command by directly embedding a
file path into an f-string without escaping. The result is passed to
`subprocess.Popen(…, shell=True)`. Shell metacharacters in the file path — most
importantly a double-quote (`"`) that br…
CVE-2026-15786
CVE-2026-61084
OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
An authorization bypass and information disclosure vulnerability exists in the search API of `Openlist`. Due to a non-separator-aware path check and unfiltered backend counting, a low-privileged user can bypass their assigned `BasePath` restrictions to discover and access metadata of fil…
Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
The `GET /api/global/groups` endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.…
Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching
The administrator-configured `WEB_FETCH_FILTER_LIST` (the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-to-markdown, web-search content fetch) matches hostnames incorrectly, so the filter can be bypassed.
## Details
`is_string_allowed` (`backend/open_webui…
Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings
When an authenticated recipient of a **single-file** share opens the file event stream (`GET /api/v4/file/events?uri=<share-root>`), Cloudreve validates the URI by listing it and then subscribes the caller to `parent.ID()`. For a single-file share, the share navigator resolves the bare …
Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails
`GET /api/v4/user/search` is available to any logged-in user. The service calls `userClient.SearchActive`, but despite its name that method filters only by email/nickname keyword and **never adds a `StatusActive` predicate** — while the sibling lookups `GetActiveByID` and `GetActiveBy…
Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account
Cloudreve's WOPI `PUT_RELATIVE` handler treats `X-WOPI-SuggestedTarget` as a path, not a filename. It splits the header on `/` and joins the segments onto the source file's directory with `URI.JoinRaw`, which feeds Go's `url.JoinPath`. `url.JoinPath` resolves `.`/`..` segments, so a sla…
Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
## Summary
Open WebUI's file upload background processing trusts the client-supplied `metadata.knowledge_id` value and inserts a `knowledge_file` association before validating that the uploading user has write a…
Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission
`POST /api/v1/images/edit` performed no authorization beyond requiring a verified account. Every other image-editing surface in Open WebUI enforces the global image-edit switch and the per-user image-generation permission — the `/api/v1/images/generations` route, the built-in `edit_ima…
Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
A post-authentication denial-of-service panic in `russh` 0.62.2 (commit
`c4be19f1915c8682f4615c3fd50008512b474491`, current default branch `main` as
of 2026-07-22). An authenticated client sends a `pty-req` channel request
carrying more than 130 terminal-mode records. The parser uses a f…
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
CVE-2026-60410
CVE-2026-60408
CVE-2026-60397
CVE-2026-60395
Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
GHSA-8fwc-qjw5-rvgp ("Gitea may send release notification emails for private repositories to users whose access has been revoked", fix in PR #36319 / commit 8a98ac22) added `repo_model.ClearRepoWatches` as a defense for the state transition public→private. The cleanup was wired into `s…
Gitea: Public-only API token restriction is not enforced on team API routes
Gitea's `/api/v1/teams/{id}` API routes do not correctly enforce the `public-only` access token restriction.
A `public-only` token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repositor…
Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform **no token-scope or
public-only enforcement**. A personal access token that is correctly blocked (HTTP 403) from a
private repository on `/raw`, `/media`, `/archive`, and `/releases/download/…` — because it is
ma…
Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
A personal access token (PAT) or OAuth2 token that does **not** carry the
`repository` scope or that is **public-only** is correctly rejected (HTTP 403)
by the recently hardened web content routes (archive download, raw/media file
download, and repository RSS/Atom feeds). However, the re…
Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
A Gitea personal access token (PAT) restricted to a non-repository scope (e.g. `read:issue`) can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied (403) on `/raw`, `/media`, `/archi…
Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
Setup: Gitea 1.26.1 docker stack with two users (`admin` and `victim`) and two OAuth applications owned by different users:
“`
Client A: id=5dda747d-7fdd-4694-85ff-ce4f893ce51e owner=admin
Client B: id=588f778f-4a41-4914-ae01-85d776c369db owner=victim…
Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
After [PR #37118](https://github.com/go-gitea/gitea/pull/37118) / **CVE-2026-25714**
(`fix: Unify public-only token filtering in API queries and repo access checks`,
merged 2026-05-18, backport `#37773` to 1.26.2 — the May 2026 unification pass
for public-only token filtering, reporter…
Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`
CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two
sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo
access at output time:
– `GET /api/v1/user/starred` — `getStarredRepos()` computes a pe…
CVE-2026-16336
Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
**Type:** Predictable identifier generation. The `toc` plugin and `TableOfContents` directive both default to generating heading IDs of the form `toc_1`, `toc_2`, `toc_3`, … with no input-derived component. An attacker who can place a heading anywhere in the document can predict which …
CVE-2026-63768
CVE-2026-13724
This issue affects Corporate Training Management System: before dd1a9df64.
CVE-2026-63761
CVE-2026-63749
Shescape: Home-directory disclosure in assignment context on Unix with Dash
This impacts users of Shescape on Unix systems that explicitly configure `shell` to Dash, or `true` when the default shell is Dash, using the `escape` and `escapeAll` APIs in assignments prefixed to a command.
An attacker may be able to obtain the location of the home directory and, dep…
Shescape: Path disclosure on Unix with Zsh
This impacts users of Shescape on Unix systems that explicitly configure `shell` to Zsh, or `true` when the default shell is Zsh, using the `escape` and `escapeAll`. The Zsh options `EXTENDED_GLOB` and `MAGIC_EQUAL_SUBST` exacerbate the problem.
In certain case, an attacker can leverage…
Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic
When an application configures hubuum_client with ClientBuilder::with_transport, several client operations still use the built-in reqwest client directly. The bypass includes password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-o…
Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects
The built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path …
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
## Summary
The `uploadUrl()` function in `packages/server/src/utilities/fileUtils.ts` uses a bare `fetch(url)` call without any SSRF protection. This function is invoked when the AI table generation feature processes LLM-gen…
Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials
The channel members endpoint serializes and returns **full user models** for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material (`settings.ui.toolServers[].key`), which…
cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag
Additionall…
Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
Kiota generates AI plugin manifests from an OpenAPI description. When the description contains an `x-ai-capabilities` response semantics `static_template` (or the adaptive-card extension `x-ai-adaptive-card`), the `file` reference is written into the generated manifest's `response_semant…
Valibot: record() issue paths can make flatten() throw for inherited Object property names
`valibot` 1.4.1 can throw a `TypeError` inside its `flatten()` helper when validation issues contain attacker-controlled object keys such as `toString`, `valueOf`, or `hasOwnProperty`.
The issue is reachable through normal `record()` validation. `record()` intentionally filters `__proto…
c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets
The JDBC spec defines the interface `DataSource`, with a method called `getConnection()`, and `ConnectionPoolDataSource`, with a method called `getPooledConnection()`. These methods are potentially dangerous. One way or another they trigger calls into JDBC drivers, which themselves are c…
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
pypdf: Possible long runtimes for repeated malformed cross-reference entries
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.
### Patches
This has been fixed in [pypdf==6.14.0](https://github.com/py-pdf/pypdf/releases/tag/6.14.0).
### Wor…
pypdf: Possible large memory usage for wrong image dimensions
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data.
### Patches
This has been fixed in [pypdf==6.14.0](https://github.com/py-pdf/pypdf/rele…
n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
The n8n Snowflake node's Execute Query operation interpolated expression values directly into the SQL string, making queries built with untrusted data susceptible to SQL injection.
Exploitation requires that a workflow author has already embedded untrusted expression data directly in a r…
n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances
The Postgres Trigger node interpolated user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping, so an authenticated user could inject arbitrary SQL executed against the connected PostgreSQL database with the configured credent…
n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner
n8n's JavaScript task runner shared one module cache across all users' Code-node executions, so a user able to run a Code node could poison a cached module and alter other users' Code-node executions on the same runner, affecting their confidentiality, integrity, or availability.
This is…
JupyterLab: PyPI extension blocklist package-name canonicalization bypass
JupyterLab PluginManager lock-rule enforcement bypass
### Impact
Users could workaround the plugi…
Next.js: Cache confusion of response bodies for requests with bodies
A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped.
This o…
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped.
This i…
Next.js: Unbounded Server Action payload in Edge runtime
Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime
## Workarounds
If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should …
Next.js: Denial of Service in the Image Optimization API using SVGs
When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in `/_next/image` endpoints.
– If you are using `conf…
Next.js: Unauthenticated disclosure of internal Server Function endpoints
In Next.js applications using App Router, Server Actions (`use server`) or `use cache` endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used.
Server Action IDs can be disclosed to unauthenticated users via publicly served client artif…
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
> FINDING — MEDIUM (HTTP/1.1 keep-alive connections with trailers)
> HttpConnection._trailers Cross-Request Leakage (Never Reset Between Requests)
>
> Location:
> jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/
> HttpConnection.java:107, 1157-1161, 11…
n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
Custom HTTP headers configured in credentials for certain LLM sub-nodes (including OpenAI, Anthropic, and Lemonade) are masked in the n8n UI but are written in plaintext into execution data during workflow runs. Any authenticated user with access to the execution data for an affected workf…
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose `allowed_routes` includes `/v1/skills`, `anthropic_routes`, or `llm_api_routes`, could upload a crafted…
n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook
The `DELETE /${restEndpoint}/test-webhook/:id` route is registered before the authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration.
The impact is limited to disrupting in-progr…
n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction
The GraphQL node did not enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (such as Header Auth, Basic Auth, Query Auth, and OAuth), unlike the HTTP Request node. An authenticated user able to create or edit workflows could therefore point the node's endpoint…
n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check
The OAuth 2.1 consent and token-issuance flow introduced in n8n 2.27.0 does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. A member-level user can register an OAuth client, self-approve consent for another user's `n8n OAuth2`-protected M…
n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows
The shell tool in the `@n8n/computer-use` package applied its sandbox restrictions only on macOS. On Linux and Windows, shell commands executed by the tool ran without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the co…
n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads
An authenticated user can repeatedly upload files to the data-table upload endpoint, bypassing the per-request quota check, which does not account for files already written to the shared temporary directory. This causes temporary files to accumulate on disk until the periodic cleanup runs,…
n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects
An authenticated user with permission to create workflows in one project could bypass project/folder authorization boundaries during workflow creation. By supplying a crafted request payload, the user could associate a newly created workflow with a folder belonging to a different project t…
n8n: External Secrets Accessible via Workflow Expressions Outside Credentials
External secrets were incorrectly resolved in workflow node expressions, where they are not intended to be available. An authenticated user with project editor access could read the plaintext value of external secrets by referencing them in a node expression, without needing explicit secre…
n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
The legacy MySQL v1 node's `executeQuery` operation substitutes evaluated `{{ … }}` expression values directly into the raw SQL string without parameterization. If a workflow uses this operation with expression-sourced values in the query and is connected to an externally-reachable trigg…
n8n: External Secrets Permission Bypass via Expression Parser Mismatch
Due to a mismatch between the static validation check and the runtime expression engine, an authenticated user with credential create or update permissions, but without the `externalSecret:list` scope, could embed external secret references into credentials in forms the validation did not …
n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory
The component `@n8n/computer-use` file-search tool confined searches to a configured base directory. A crafted search pattern could bypass the confinement check and expand to locations outside that directory, causing the tool to return the names and contents of files anywhere the daemon's…
n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service
An authenticated user able to create or edit a workflow expression could abuse the expression engine's array-element access to obtain a reference to a host built-in and pollute its prototype in the main n8n process, leading to a denial of service.
Both self-hosted and cloud instances run…
n8n: SSRF Protection Bypass via MCP Client Node
On an n8n instance with SSRF protection enabled, the MCP Client node sent requests to a user-supplied endpoint without routing them through that protection and without pinning the resolved address. An authenticated user who could create or edit a workflow could therefore cause the server …
Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
`HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound …
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP reques…
Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations
There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as `<use>`. See related [GHSA-9wjq-cp2p-hrgf](https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf) in Loofah, w…
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
Gitea has robust SSRF protection via `hostmatcher.NewDialContext()` for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw `http.Get()` (Go's `DefaultClient`) which completely bypasses this protection, enabling SSRF to…
Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
PR #38145 fixed ListPublicMembers and IsPublicMember but missed
ListMembers. Any authenticated user can enumerate ALL members
(not just public ones) of a private organization.
## Affected Versions
<= v1.26.4 (latest) and main branch
## Root Cause
routers/api/v1/org/member.go — ListM…
Gitea SSH Key Parser Denial of Service
Gitea: Local File Inclusion via file:// URI in Migration Restore
Target: go-gitea/gitea
Component: services/migrations/gitea_uploader.go, modules/uri/uri.go
Severity: High
Affected Versions: <= v1.22.x (all releases), master as of latest commit
Researchers:
– Isa Can — Eresus Security (https://github.…
Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
The OIDC userinfo endpoint (`GET /login/oauth/userinfo`) accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims.
A personal access token scoped only to `read:misc` can successfully retrieve user information from the OIDC us…
Gitea: REST API exposes organization membership of private organizations to public
The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organization.
### PoC
1. Spin up the nightly container of Gitea.
2. Perform the default installation.
3. Register a new user (let's call this user "user1").
4. Cr…
Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions
The API endpoint used to fork repositories into organizations performs a weaker authorization check than the corresponding web UI and other repository creation endpoints.
When a repository is forked into an organization through the API, the endpoint only verifies that the user is an or…
Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Hello Gitea Security Team,
Thank you for your continued work on Gitea. I would like to responsibly report a potential availability-impact issue that I observed in Gitea’s Arch package registry implementation.
During local testing, I noticed that Gitea records non-dot regular file ent…
Mistune: XSS via unescaped class option in Admonition directive
This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used.
The directive name parameter…
pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read
An integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) o…