Curated security, hosting and development news with vulnerability warnings from fixed trusted sources.
CISA KEVGHSACERT.atHosting
Updated
About these news
Articles are collected periodically from a fixed source list. D4rC Tools stores the headline, source summary and source link only; linked articles are not fetched on page view.
Microsoft Security Advisory CVE-2026-118749 - ASP.NET Core Denial of Service Vulnerability
·GitHub Advisories
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Minimal API validation repeatedly copies a growing validation-error dictionary, allowing attacker-controlled collections to trigger quadratic CPU work after the client disconnects. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/505 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-407 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The…
Microsoft Security Advisory CVE-2026-114149 - ASP.NET Core Denial of Service Vulnerability
·GitHub Advisories
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Multipart form processing can bypass the configured header-count limit and consume excessive resources. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/511 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-770 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version ranges and fixed package versions. Runtime and s…
Microsoft Security Advisory CVE-2026-109476 - ASP.NET Core Information Disclosure Vulnerability
·GitHub Advisories
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. A crafted X-Forwarded-Prefix can inject cookie path delimiters unless PathBase-derived cookie paths percent-encode semicolons. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/508 ## CVSS Details - **Version:** 3.1 - **Severity:** Medium - **Score:** 6.1 (base score) - **Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C - **Weakness:** CWE-116 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version ranges and fixed pack…
React: Unauthenticated Remote Code Execution in React Server Components
·GitHub Advisories
### Impact Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Updating immediately is recommended. The vulnerability exists in versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 and 19.3.0 of: - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack ### Patches Fixes were back ported to versions 19.0.09, 19.1.10, 19.2.9, and 19.3.1. If applications are using any of the above packages please upgrade to any of the fixed versions immediately. If an app’s React code does not use a server, the app is not affected by this vulnerability. If an app does not use a framewor…
compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages
·GitHub Advisories
### Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in compose-lint's own output, but not in the argument parser's error messages. When a repository path reaches compose-lint's arguments without a -- before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a command can also start a new line there. A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed. Affected setups pass repository paths to compose-lint with…
compose-lint: Workflow command injection through SARIF-directory errors triggered by pull request symlinks
·GitHub Advisories
### Impact In Action tags v0.30.0 and v0.31.0, when sarif-file: names a file in a subdirectory that can't be created, the Action prints the directory's resolved path in an error message. In v0.31.0 that message is outside the window in which the Action turns command processing off, and v0.30.0 has no such window. A pull request can commit a symlink on that path to a directory whose name contains a newline followed by a command. A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed. Only the Action is affected, and only when sarif-file: points into a subdirectory. The documented setup, sarif-file: results.sarif at t…
compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout
·GitHub Advisories
### Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. --format json and --format sarif output never passed through that fix, so ##[ inside a service name or other value reaches the log intact when the output is printed to stdout rather than written to a file. The runner acts on ##[ in the middle of a line, so the JSON layout does not prevent it. A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed. Affected setups print JSON or SARIF output to a CI log from the compose-lint package, the pre-commit hook or the Docker image.…
Active Storage: Possible arbitrary file read and remote code execution in video previews, analysis and image processing
·GitHub Advisories
### Impact ActiveStorage::Blob#open writes a blob to a tempfile whose name carries the extension of the uploaded filename, and hands that path to ffprobe (VideoAnalyzer, AudioAnalyzer), ffmpeg (VideoPreviewer) and ImageMagick (ImageAnalyzer, the :mini_magick variant processor). These tools select a decoder from the file extension when the content does not identify its own format, so an attacker who chooses the filename and declares the content type of an upload chooses which decoder processes it. An FFmpeg built with AviSynth support treats a file with the .avs extension as an AviSynth script and evaluates it, which could disclose files readable by the application process through the preview image, or load a native library the attacker has also uploaded, possibly leading…
Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
·GitHub Advisories
### Impact ActiveStorage::Service::GCSService#url_for_direct_upload does not bind the declared content length into the signed direct-upload URL, and #headers_for_direct_upload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the byte_size it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service. Applications that store files in Google Cloud Storage and accept direct uploads are affected. ### Details The fixed releases sign an x-goog-content-length-range header that matches the blob's declared byte_size and return it from headers_for_direct_upload, so Cloud Storag…
Active Support: Possible DoS vulnerability in Active Support safe_constantize
·GitHub Advisories
### Impact When constant lookup raises LoadError, ActiveSupport::Inflector#safe_constantize (and String#safe_constantize) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests could keep the application unavailable. Action Cable passes the channel value of each subscribe command to safe_constantize before any channel lookup, so in the default configuration an unauthenticated client of the Action Cable endpoint can reach this code. ### Details The check that decides whether `safe_consta…
Duplicate Advisory: Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability
·GitHub Advisories
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q6jf-24jf-m3cg. This link is maintained to preserve external references. ## Original Description Insertion of sensitive information into log file in .NET Aspire allows an authorized attacker to disclose information locally.
Duplicate Advisory: Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability
·GitHub Advisories
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m63f-xhvm-6mv5. This link is maintained to preserve external references. ## Original Description Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.
Active Storage: Possible DoS vulnerability in Active Storage filename handling
·GitHub Advisories
### Impact ActiveStorage::Filename#base and #extension_with_delimiter, and therefore #extension, pass the stored filename unmodified to File.basename and File.extname, which raise ArgumentError when the name contains a NUL byte. Active Storage stores the client-supplied filename verbatim, so a user who is permitted to upload an attachment could persist such a filename on databases that accept NUL bytes in string columns, such as SQLite and MySQL/MariaDB. Each subsequent request that builds a variant or preview of the blob, opens it, or renders it as an Action Text attachment then raises, possibly resulting in a persistent DoS vulnerability for the pages that display the blob until it is purged or its filename is corrected. Applications that use PostgreSQL are not affected, bec…
Duplicate Advisory: Microsoft Security Advisory CVE-2026-114157 - ASP.NET Core Security Feature Bypass Vulnerability
·GitHub Advisories
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7phj-vgxq-r67h. This link is maintained to preserve external references. ## Original Description Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.
Duplicate Advisory: Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability
·GitHub Advisories
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3893-7fxc-qvff. This link is maintained to preserve external references. ## Original Description Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Duplicate Advisory: Microsoft Security Advisory CVE-2026-114147 - ASP.NET Core Denial of Service Vulnerability
·GitHub Advisories
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wr8v-9x5q-ggcm. This link is maintained to preserve external references. ## Original Description Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Duplicate Advisory: Microsoft Security Advisory CVE-2026-114156 - ASP.NET Core Security Feature Bypass Vulnerability
·GitHub Advisories
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8w29-6cjc-h6w4. This link is maintained to preserve external references. ## Original Description Improper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress
·GitHub Advisories
### Impact The Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent? rejects only timestamps more than 2 minutes in the past. Because the signature does not fix the boundary between the two values, a captured signed request can be presented with a timestamp far in the future, which the ingress then accepts indefinitely. An attacker who obtains one signed Mailgun webhook request, but not the signing key, could submit arbitrary inbound email that Action Mailbox processes as genuine, possibly leading to forged messages attributed to the sender of the attacker's choosing. Applications that receive inbound email throug…
Active Support: Possible XSS vulnerability in Active Support MessagePack serializer
·GitHub Advisories
### Impact ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new SafeBuffer, so a buffer that is no longer html_safe? (for example, one mutated in place with gsub!) is restored as html_safe. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS. Applications on Rails 8.1 are affected if they use a MessagePack serializer, such as config.action_dispatch.cookies_serializer = :message_pack or :message_pack_allow_marshal, or serializer: :message_pack for Rails.cache, ActiveSupport::MessageVerifier or ActiveSupport::MessageEncryptor, and store a SafeBuffer that was mutated in place with untrust…
Action Pack: Possible cache poisoning in Action Pack content negotiation
·GitHub Advisories
### Impact Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but ActionController::Rendering#_set_vary_header adds Vary: Accept only when the request carries a usable Accept header and the response has no Vary header yet. A response to a request without Accept, or to an XHR request, therefore omits the headers that selected its representation, and a response whose Vary the application set before rendering (for example Vary: Accept-Language) never gains Accept. A shared cache that honours Vary could store such a response and serve it to later clients that request a different representation, possibly leading to cache poisoning in which visitors receive, unti…
Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores
·GitHub Advisories
### Impact Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass `same_si…
Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming
·GitHub Advisories
### Impact When Active Storage serves a file through its proxy controllers, ActiveStorage::Streaming#send_blob_stream handles an error from the storage service by calling head to send a 404 or 500 response. If the error occurs after the first chunk has been written, the response is already committed, and head replaces the response body while the server is still reading the original ActionController::Live buffer. That buffer is never closed, so the server thread handling the request blocks until the process restarts. Repeated failed downloads could exhaust the server's threads, possibly resulting in a DoS vulnerability. Applications are affected when they store files on a service that streams a download in several requests, such as Amazon S3, an S3-compatible service or Google Clou…
Action Pack: Possible IP spoofing in Action Dispatch RemoteIp
·GitHub Advisories
### Impact Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remote_ip from Rack::Request#forwarded_for, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a reverse proxy appends the client address to X-Forwarded-For but passes a client-supplied Forwarded header through unchanged, request.remote_ip returns an address chosen by the client, and the IP spoofing check does not raise, because it compares only Client-Ip with the forwarded addresses. An unauthenticated attacker could therefore spoof request.remote_ip, possibly bypassing IP-based access controls and rate limits keyed on the client address (including the default by: of rate_limit), and falsifying the client address in logs. ### Details The 8.1.0 change (…
Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore
·GitHub Advisories
### Impact ActionDispatch::Session::CacheStore writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through reset_session on logout or by deleting its cache entry on the server, a request that loaded the session earlier and finishes later restores it under its original session ID. Logout and server-side revocation could therefore fail to end a session, and an attacker who holds a stolen session cookie could keep that session valid across the victim's logout. Applications that use config.session_store :cache_store are affected, with any cache backend. ActionDispatch::Session::CookieStore is not affected, nor is `ActionDispatch::Session::MemCacheStor…
Forge: Ed25519 signature verification accepts small-order public keys
·GitHub Advisories
### Summary ed25519.verify() does not reject public keys of small order, such as the identity point. Under such a key, a signature with S = 0 and a small-order R verifies for many messages, or for every message with the identity key, without any private key. Fixed in node-forge 1.4.3. ### Details crypto_sign_open() in lib/ed25519.js decodes the public key A with unpackneg(), which only checks that the point is on the curve, and then checks R == [S]B - [k]A with k = SHA-512(R || A || M). Nothing rejects public keys of small order: the identity point, the other 7 points of order 2, 4 or 8, and their non-canonical encodings with y >= p. With S = 0, the check becomes R == [k](-A). For a small-order A, [k](-A) is one of at most 8 small-order points, so an attacker c…
Forge: TLS client crash on an unsupported ServerHello compression method
·GitHub Advisories
### Summary A forge.tls client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes connection.process() throw an uncaught Error when the client handles ServerHelloDone, before the server is authenticated. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3. ### Details The client's ClientHello offers only the null compression method. tls.parseHelloMessage() in lib/tls.js stores the ServerHello's compression_method for the client without checking it (the code has a TODO: handle compression methods). When the client handles ServerHelloDone it calls tls.createConnectionState(), which throws Error('Unsupported compression algorithm.') for any method o…
Forge: ReDoS in forge.http response header and cookie trimming
·GitHub Advisories
forge.http trims response header and Set-Cookie values with the regular expression /\s*$/, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a forge.http client for minutes with one large response header. Fixed in node-forge 1.4.3. ### Details _trimString() in lib/http.js removes trailing whitespace with str.replace(/\s*$/, ''). On a string of n whitespace characters followed by a non-whitespace character, the regular expression engine tries a match at each of the n positions and scans the rest of the run each time, so the work is O(n^2). forge.http calls _trimString() on every response header value read by response.readHeader(), and again on cookie names and values in response.getCookies(). T…
Forge: TLS client crash on a handshake record received without a session
·GitHub Advisories
### Summary A forge.tls client throws an uncaught TypeError from connection.process() when it receives a ServerHello while it has no session: after a close_notify alert or a call to close(), or before handshake() is called. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3. ### Details tls.handleHandshake() in lib/tls.js updates the handshake digests with c.session.md5.update(bytes) before it calls the message handler. A client creates its session in handshake(), and c.reset() sets it to null when the connection is closed. Closing doesn't set the fail flag, and the client goes back to expecting a ServerHello, so a Handshake record received afterwards still reaches handleHandshake(), which throws `Type…
fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags
·GitHub Advisories
### Summary With the non-default stopNodes option, a stop node's body with many "" anywhere after makes readStopNodeData() rescan the entire remaining input from every "
Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections
·GitHub Advisories
### Summary Mongoose chooses which discriminator model or schema to use by looking up the discriminator key value (__t by default) in a plain object of registered discriminators, for example Model.discriminators[doc.__t]. That value comes from user documents and query filters. Because the lookup did not check own properties, a value that names a property inherited from Object.prototype resolves to that inherited value instead of a discriminator. Examples are 'constructor', 'toString' and 'hasOwnProperty'. - __t: 'constructor' resolves to the global Object function. Mongoose then calls new Object(doc), which returns the raw user object where a Mongoose document is expected. - __t: 'toString' and similar names resolve to built-in functions that throw when used as a const…
Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state
·GitHub Advisories
### Summary Three Mongoose code paths copy data into objects by property name without checking whether the property is the object's own or inherited from its prototype: 1. Loading a document from the database (init(), also used by Model.hydrate()) 2. Setting a dotted path on a document ($__set, used by new Model(obj), doc.set() and doc.$set()) 3. Merging update documents (utils.mergeClone, used by findOneAndReplace(), chained update calls and Query.prototype.merge()) When a key names an inherited property, such as toString or valueOf, or a document internal such as $__schema, Mongoose writes into the shared object behind that property. The data comes from the attacker. - **Denial of service.** For example, { "toString": { "call": 1 } } overwrites `Object.prototyp…
JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host
·GitHub Advisories
### Summary On JRuby, the NONET parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as http://127.1/ or http://169.254.43518/, or was an absolute path such as /x.dtd in a document parsed from a network URL. An application that parses untrusted XML with DTDLOAD, DTDVALID or NOENT could be made to send network requests, potentially enabling SSRF. Nokogiri 1.19.5 applies the XML::Schema check from [GHSA-8678-w3jw-xfc2](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2): with NONET set, only local resources are loaded. Only JRuby is affected. Default parse options are not affected. ### Severity The Nokogiri maintainers have evaluated this as low severity. ### Mitigation Upgrade to Noko…
Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value
·GitHub Advisories
### Summary Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang=. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault. This is the same class of issue as [GHSA-phwj-rprq-35pp](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp), which was fixed for Attr#value= in Nokogiri 1.19.4. Nokogiri 1.19.5 preserves all already-wrapped attribute child nodes before replacing the attribute value. JRuby is not affected. ### Se…
Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer
·GitHub Advisories
### Summary Nokogiri's HTML5 serializer did not escape text inside noscript elements, or `` inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with Nokogiri::HTML5, allow noscript elements, and send the serialized output to browsers. Nokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Text inside noscript is still emitted unescaped for documents parsed with parse_noscript_content_as_text: true. Only the C extension (CRuby and TruffleRuby) is affected. JRuby does not implement Nokogiri::HTML5. ### Severity The Nokogiri maintainers have…
Mongoose: Prototype pollution via Schema.prototype.virtual()
·GitHub Advisories
### Summary Prototype pollution via Schema.prototype.virtual() — the 2022 fix for CVE-2022-2564 / CVE-2022-24304 protected Schema.path()/add() but never virtual(), so the same class of bug is still exploitable in all maintained release lines. ### Details In lib/schema.js, Schema.prototype.virtual() (defined at line 2643) builds the virtual path via: ``javascript virtuals[name] = parts.reduce(function(mem, part, i) { mem[part] || (mem[part] = (i === parts.length - 1) ? new VirtualType(options, name) : {}); return mem[part]; }, this.tree); // lines 2755-2759 `` Unlike path()/add(), virtual() never received the specialProperties check added for CVE-2022-2564/CVE-2022-24304 (lib/schema.js lines 806, 1308, 1331). A path containing __proto__/constructor/prototype segments reso…
Mongoose: Connection-level sanitizeFilter not applied
·GitHub Advisories
### Summary sanitizeFilter exists to stop query selector injection: it wraps operator objects such as { $ne: null } in filter values in $eq, so they are matched literally. Set on a connection with mongoose.connect() or createConnection(uri, { sanitizeFilter: true }), the connection reports it as enabled but queries never apply it. An application that relies on the connection-level option and passes an attacker-controlled object into a filter therefore remains open to selector injection, and a password value of { $ne: null } returns the account record without the password. ### Details NativeConnection#createClient() at lib/drivers/node-mongodb-native/connection.js:270-272 moves options.sanitizeFilter into Connection.config and deletes the original option. `Query#_castCond…
Mongoose: sanitizeFilter not applied on countDocuments
·GitHub Advisories
### Impact sanitizeFilter is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, sanitizeFilter was not applied for countDocuments() queries. ### Patches Patches have been released for all supported Mongoose major release lines. Please upgrade to the following versions depending on which major version of Mongoose applications are using. 1. ^9.9.2 2. ^8.24.3 3. ^7.8.12 4. ^6.13.11 ### Workarounds Middleware: ``javascript mongoose.plugin(function() { schema.pre('countDocuments', function() { // This will always apply sanitizeFilter on countDocuments mongoose.sanitizeFilter(this.getFilter()); }); }); ``
Rack: Multipart parsing allows DoS via unbounded scan buffer growth
·GitHub Advisories
## Summary Rack::Multipart::Parser reads the request body in chunks of rack.multipart.buffer_size (1 MiB by default) into an internal scan buffer. Parsed bytes are only discarded from that buffer when a chunk ends inside a part body. A request whose parts are sized so that every chunk ends inside, or immediately after, a part's headers is never compacted, so the buffer grows to the size of the request. This results in a denial of service condition through memory exhaustion for applications that parse multipart requests. ## Details The parser appends each chunk read from the input to a StringScanner and advances through boundaries, headers, and bodies. In the body state, when no closing boundary is found, the consumed prefix is removed before more data is read. In the header state, a…
Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass
·GitHub Advisories
## Summary The guard added for CVE-2026-26961 (GHSA-vgpv-f759-9wx3), which rejects multipart requests with more than one boundary parameter, only inspects the part of the Content-Type header after the boundary it extracts. A Content-Type whose first boundary parameter is empty or begins with a quote, semicolon, or comma is skipped by the extraction pattern, so a second boundary parameter is accepted silently and Rack parses the body with a boundary that a conforming parser would not derive from the header. ## Details Rack::Multipart::Parser.parse_boundary extracts the boundary with a regular expression that uses a lazy prefix and a value class excluding ", ;, and ,. For a header such as multipart/form-data; boundary=";boundary=AaB03x" or `multipart/form-data; boundary=…
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
·The Hacker News
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1. The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An
NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides
·GitHub Advisories
### Summary A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the @nocobase/plugin-action-custom-request plugin. A low-privileged authenticated user can call the customRequests:send endpoint and override the stored request URL at runtime using options.url. This causes the NocoBase server to perform outbound HTTP requests to attacker-controlled or internal URLs. * Product: NocoBase * Version: v2.1.10 * Component: @nocobase/plugin-action-custom-request * Severity: Moderate * Required privilege: authenticated low-privileged user / member Testing was performed only in a local Docker lab environment at http://127.0.0.1:13000. No public NocoBase instance was tested. Lab environment: * Docker image: nocobase/nocobase:latest-full * Commit: `23e2bd35625439594e47…
SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users
·The Hacker News
An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday. The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE
Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835
·GitHub Advisories
## Summary Rack::Request#host_with_port, and therefore #base_url and #url, return the raw authority string when it fails validation. An attacker-controlled Host, X-Forwarded-Host, or Forwarded: host= value containing characters that are not permitted in an authority is embedded verbatim in URLs generated by the application. This completes the fix for CVE-2026-34835 (GHSA-g2pf-xv49-m2h5), which made #host and #hostname return nil for an invalid authority but left this path unchanged. ## Details Rack::Request#host_with_port splits the authority with split_authority. When the AUTHORITY pattern does not match, no components are returned and host_with_port falls back to returning the unvalidated authority string. base_url is "#{scheme}://#{host_with_port}" and `ur…
Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch
·GitHub Advisories
## Summary Rack::Static normalizes the request path with Utils.clean_path_info when deciding which file to serve, but matches header_rules against a path that is only URL-decoded. A request containing dot segments, raw or percent-encoded, is served the normalized target file while the header rules for that file's location are not applied. This allows an attacker to receive a protected static file without the security headers configured for it. ## Details Rack::Static#call computes the served path as Utils.clean_path_info(Utils.unescape_path(path)). Rack::Static#applicable_rules applies only Utils.unescape_path before testing string and regular expression rules. A request for /assets/../uploads/file.html or /assets/..%2fuploads/file.html is served as uploads/file.html,…
compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output
·GitHub Advisories
### Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in everything compose-lint prints, and the 0.31.0 changelog says the report "escapes both openers (also covering Azure Pipelines)". Five paths were left open: - **Unicode whitespace before a line-leading ::.** The runner strips all Unicode whitespace from the start of a line before it looks for a command. compose-lint only accounted for spaces and tabs, so a no-break space or another Unicode space ahead of :: is not escaped. It can come from a Compose value, or from a file name: the text report's file heading and per-file summary, and the fix summary on stderr, start with the path as given, so a directory na…
Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access
·The Hacker News
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062. "REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the
Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
·The Hacker News
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. Check Point Research is tracking the clusters under the names SilentDelivery,
Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
·The Hacker News
Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
·The Hacker News
The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat. "The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and
OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document
·GitHub Advisories
### Summary An XSS (Cross-Site Scripting) vulnerability occurs when an attacker is able to inject their own JavaScript code into a web page's source, which is subsequently processed by the victim's browser. A common cause of this vulnerability is the failure to validate user-supplied data before displaying it within the vulnerable application without proper filtering. To exploit the vulnerability, an attacker must input HTML code into a vulnerable parameter containing structures that trigger the execution of JavaScript. The DOM XSS variant occurs when user-supplied data is processed by a client-side script; if this data is not handled correctly by the script itself, it becomes possible to inject additional JavaScript commands. **Attacker model:** Any actor who can get a DICOM object in fr…
Forge: Certificate signature verified with the issuer's RSA signature scheme
·GitHub Advisories
### Summary When verifying a certificate, node-forge chose the RSA padding scheme (PKCS#1 v1.5 or RSASSA-PSS) and PSS parameters from the issuer certificate's own signature algorithm instead of the certificate being verified. A certificate labeled as signed with RSASSA-PSS could pass verifyCertificateChain() with a PKCS#1 v1.5 signature. Fixed in node-forge 1.4.1. ### Details certificate.verify(child) in lib/x509.js hashes the child's TBSCertificate with the digest of the child's signature algorithm, then calls _verifySignature() with the issuer certificate. _verifySignature() selected the padding scheme from that certificate's signatureOid and signatureParameters, so the child was verified with the issuer's own scheme rather than the one the child declares. As a result, a c…
Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
·GitHub Advisories
### Summary decipher.finish() in CBC and ECB mode accepted malformed PKCS#7 padding: only the last byte was checked, against a limit of four blocks, so mismatched padding bytes, a zero count and oversized counts were accepted and up to four blocks of plaintext could be silently removed. Fixed in node-forge 1.4.1. ### Details modes.cbc.prototype.unpad() and modes.ecb.prototype.unpad() in lib/cipherModes.js read the last decrypted byte as the PKCS#7 padding count, rejected it only if it was larger than `blockSize
Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
·GitHub Advisories
### Summary forge.pki.verifyCertificateChain() enforces the pathLenConstraint of a CA certificate's basicConstraints extension only when that certificate also has a keyUsage extension. For a CA certificate with a pathLenConstraint and no keyUsage, chains with more intermediate CA certificates below it than the constraint allows are accepted. Fixed in node-forge 1.4.1. ### Details In pki.verifyCertificateChain() (lib/x509.js), the path length check for a CA certificate was guarded by keyUsageExt !== null && 'pathLenConstraint' in bcExt. The keyUsage test was originally a proxy for "a basicConstraints extension exists". Since node-forge 1.4.0 (GHSA-2328-f5f3-gj25), basicConstraints is required for every certificate that reaches this check, so the only remaining effect of…
Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
·GitHub Advisories
### Summary asn1.fromDer() decodes the contents of BIT STRINGs as ASN.1 by default. That decode ignored the maxDepth recursion limit (an incomplete fix of CVE-2025-66031) and also decoded nested BIT STRINGs, keeping a full copy of the decoded contents at each level, so small crafted DER or PEM inputs (certificates, keys, PKCS structures) use excessive CPU time and memory and can abort the Node.js process. Fixed in node-forge 1.4.1. ### Details asn1.fromDer() attempts by default to decode the contents of primitive BIT STRINGs as ASN.1 (decodeBitStrings, default true). Two flaws in that decode in lib/asn1.js allow resource exhaustion: 1. _fromDer() started the BIT STRING decode with a new options object, {strict: true, decodeBitStrings: true}, that did not include maxDepth…
Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding
·GitHub Advisories
### Summary RSASSA-PKCS1-v1_5 signature verification (publicKey.verify() with the default scheme, also used by X.509 certificate and PKCS#7 verification) accepted non-canonical BER encodings of the DigestInfo, such as NULL parameters with content and non-minimal lengths. These leave attacker-controlled bytes inside an accepted DigestInfo, which allows signatures to be forged without the private key for RSA keys with a low public exponent (e=3). Fixed in node-forge 1.4.1. ### Details In lib/rsa.js, key.verify() with the default RSASSA-PKCS1-V1_5 scheme removes the padding, parses the recovered DigestInfo with the lenient BER parser asn1.fromDer() and checks its structure with asn1.validate() against digestInfoValidator. Neither requires a canonical DER encoding, so verificati…
Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
·GitHub Advisories
### Impact The name, domain, and path fields of makeCookie() were validated with a regex that allows ;, the attribute separator in Set-Cookie headers. Because serializeCookie() writes those fields verbatim, a caller who passes untrusted input into any of them can append arbitrary attributes to the header. For example, a domain of "legit.com; Domain=.parent.tld" serializes to session=token; Domain=legit.com; Domain=.parent.tld. RFC 6265 §5.3 takes the last occurrence, so the injected domain wins and the cookie widens to the parent domain. The same trick sets SameSite=None or Max-Age when the caller has not set those options itself. The value field is unaffected: it passes through encodeURIComponent, which encodes ;. CR and LF are rejected by the existing regex…
OctoPrint: Stored XSS via saved connection parameters
·GitHub Advisories
## Impact OctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default port or baudrate setting on the bundled Serial Connector plugin, supplied via the API as new defaults during a connect request. ## Patches The vulnerability is patched in 2.0.0rc7. ## Workaround Check config.yaml for Javascript fragments in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate. If found, remove them. You can check who of your users had access to your instance since you flashed 2.0.0rc1 or above via auth.log. ## Credits This vulnerability was discovered and responsibly disclosed to OctoPrint by "mahn-don". ## Timeline 2026-10-14: Report received 2026-10-14: Report acknowledged 2026-10-…
Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
·GitHub Advisories
### Summary Altair 8.5.7 accepts plugin configuration directly from the iframe-sandbox query string. When plugin_sandbox_opts contains type: "scripts" and an attacker-controlled URL in scriptUrls, the sandbox page creates a classic `` element and loads the supplied script. In the intended plugin flow, this page runs inside an `` without allow-same-origin, giving plugin code an opaque origin. However, if a victim opens the crafted sandbox URL directly, that iframe isolation is absent and the attacker-controlled script executes in the origin serving Altair, resulting in DOM-based cross-site scripting (XSS) / arbitrary JavaScript execution in the Altair hosting origin. Exploitation requires the victim to open a crafted URL. ### Details The sandbox reads its configuration directly…
bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list
·GitHub Advisories
### Summary fastMerkleRoot pads an odd level by hashing the last node with itself. It does not report that it did so, and checkTxRoots never looks for repeated transactions. A peer can therefore duplicate transactions to fill the pad and produce a block with a different transaction list but the same merkle root. The block hash and block id do not change, so the header still carries valid proof of work. In the proof of concept a real mainnet block goes from nine transactions to ten, and separately to twelve, with the same id every time, and checkTxRoots accepts all three. Bitcoin Core rejects this case through the mutated flag in ComputeMerkleRoot and the bad-txns-duplicate reason in CheckBlock. This is CVE-2012-2459. ### Details A bitcoin merkle tree pads an odd level by has…
compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`
·GitHub Advisories
### Impact This is an incomplete fix for GHSA-jf3h-8jvx-vcrg. 0.32.0 made findings quote the ${NAME} a sibling .env filled in, instead of its value. The same release added a stop at 20,000 findings per document, and that stop is checked before the quoting step. A run that hits it reports the findings graded so far with the resolved values still in them, in text, JSON and SARIF output. That happens with or without --allow-partial-coverage. The attack is the one GHSA-jf3h-8jvx-vcrg describes. In a CI workflow that writes secrets into the .env beside the Compose file, a pull request changes a line to image: "${DB_PASSWORD}". It also pushes the document past 20,000 findings, which a few hundred lines can do, because an aliased list is graded once for each service that uses it. The s…
GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover
·GitHub Advisories
### Impact An authenticated non-administrative user could access a Kubernetes cluster they are not authorized to access through GPUStack's Kubernetes API proxy. The cluster_apiserver_proxy handler did not perform a resource-level authorization check before forwarding requests to the selected cluster. Requests were forwarded through a worker using its Kubernetes ServiceAccount credentials. Depending on the permissions granted to that ServiceAccount, an attacker could read sensitive Kubernetes resources, create or modify workloads, or delete resources and disrupt services. Creating attacker-controlled workloads could result in code execution in the target cluster. Exploitation requires a Kubernetes-provider cluster with a reachable worker. The operations available to the attacker are limi…
AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution
·GitHub Advisories
### Summary SandboxShellTool's restricted modes — allowed=[...] (explicit command allowlist) and readonly=True (implicit READONLY_COMMANDS allowlist) — can both be bypassed by embedding a newline character inside the command string. The filter only inspects a single-line set of shell metacharacters, but execution runs the raw string through sh -c, where a shell treats an embedded newline exactly like a ; statement separator. An agent (or content that steers the agent, e.g. via prompt injection) can therefore run arbitrary shell commands even when the tool was configured to allow only a specific command prefix or only read-only commands. With the default LocalEnvironment() backend this is a real host subprocess (its own docstring: "Commands run via subprocess on the host, so there is n…
GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
·GitHub Advisories
### Impact The callback Base64-decodes the posted XML, reads NameID and attributes, resolves or provisions the user, and mints a gpustack_session JWT — but never calls OneLogin_Saml2_Auth.process_response(), the step that verifies the signature, issuer, audience, destination, and time conditions. No credentials are required, and SAML SSO does not even need to be configured. The callback processes the payload and issues a session regardless of whether SAML is set up, so every deployment is affected, not only SAML-enabled ones. Anyone who can reach the endpoint over the network can authenticate as an arbitrary identity by posting a response that names it: - If the name matches an existing user (e.g. an administrator), the attacker receives that user's session — full account takeover, includ…
Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API
·GitHub Advisories
### Summary The POST /__nuxt_content/:collection/query endpoint in @nuxt/content accepts an attacker-controlled sql field from the HTTP request body and executes it against a local SQLite database after passing it through an insufficient validator (assertSafeQuery). The validator only blocks a small set of SQL command keywords and does not reject expensive SQLite built-in functions such as randomblob(), zeroblob(), hex(), or length(). An unauthenticated remote attacker can craft a single request that forces SQLite to allocate hundreds of megabytes of memory and perform CPU-intensive work, causing server-wide denial of service. This endpoint is enabled by default for every collection and requires no authentication. ### Details The vulnerability spans three source files: **R…
compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output
·GitHub Advisories
### Impact Like Docker Compose, compose-lint follows symlinks when it reads a project's files. Unlike Compose, compose-lint up to 0.24.0 could then put the contents of a file from *outside* the project into its output, where the author of a pull request can read it. A pull request can commit a symlink, under a name compose-lint reads, pointing at a file on the CI runner: - **The Compose file itself (0.2.0–0.24.0).** A compose.yml that is a symlink, whether the pre-commit hook passes its name or the Action or a bare run finds it. - **compose.override.yml (0.22.0–0.24.0),** which compose-lint merges automatically. - **A COMPOSE_FILE entry (0.22.0–0.24.0)** in a .env beside the Compose file. When the target is not valid YAML, the parse error quotes the line it failed on. Docker Compo…
compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target
·GitHub Advisories
### Impact compose-lint automatically reads a .compose-lint.yml policy file beside the Compose file. It is meant to read nothing outside the project directory, but it follows that file if it is a symlink, wherever it points. A pull request can commit .compose-lint.yml as a symlink to a file on the CI runner. If the target is not valid YAML, the error compose-lint reports quotes part of the line the parser failed on. That quote reaches the job log (standard error), JSON errors[], and the SARIF toolExecutionNotifications, which the Action uploads to Code Scanning. The run exits 2. What can be read is small. The quote is cut to about 30 characters around the error position, and the attacker cannot choose which line of the target the parser fails on. For an INI-style credentials file,…
compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings
·GitHub Advisories
### Impact Since 0.22.0, compose-lint fills in ${VAR} references from the .env beside the Compose file, as Compose does. The documentation says values under environment: are never resolved from a .env, "that is where secrets live". But image: values are resolved, and CL-0004 and CL-0019 quote the resolved image in their message and fix text. Some CI workflows write secrets into that .env before linting or building. In such a workflow, a pull request that changes one line to image: "${DB_PASSWORD}", or image: "nginx:${DB_PASSWORD}", gets the secret's value quoted in a finding. The finding reaches the job log, JSON output, and the SARIF uploaded to Code Scanning. GitHub masks registered secrets in the job log, but not in uploaded JSON or SARIF artifacts or in Code Scanning a…
compose-lint: `fix --apply` can delete a line the user did not select, including a security setting
·GitHub Advisories
### Impact compose-lint fix --apply converts the line numbers its fixers work with into positions in the file. The YAML parser treats a lone carriage return, U+0085, U+2028 and U+2029 as line breaks, but the conversion counted only \n. One of those characters inside a quoted value, which most editors and diff views don't show, shifted every later edit down by one line. A Compose file from a pull request can use this to make a fix delete the line after the one it meant to change. For example, fixing CL-0014 (logging: driver: none) instead removes driver: none and the following networks: [internal], moving the service off an internal-only network onto the default bridge. The result is still valid Compose, every check fix runs after editing passes, and the command reports `applie…
compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
·GitHub Advisories
### Impact The GitHub Actions runner treats certain text in a step's output as commands. The legacy form, ##[command], is recognized anywhere in a line. compose-lint's text report prints service names, environment keys and lines of the Compose file, and it does not neutralize ##[. Inside the compose-lint Action, a Compose file from a pull request can therefore: - create fake error or warning annotations on the pull request (##[error], ##[warning]) - fold the rest of the log, including the real verdict, out of sight (##[group]) - blank out chosen strings for the rest of the log (##[add-mask]) GitHub has postponed removing the deprecated set-output log command, so the runner still honors it. A test run of the Action on a GitHub-hosted runner confirmed that a ::set-output lin…
compose-lint: .env read through a symlink outside the project can expose the CI job's environment
·GitHub Advisories
### Impact compose-lint fills in ${VAR} references from the .env file next to the Compose file. It is meant to read nothing outside the project directory, and env_file:, include: and extends: paths are checked for that. The .env read is not. If .env is a symlink, compose-lint follows it wherever it points. A pull request can add a .env symlink to any file on the CI runner and a Compose file that references a variable from it. compose-lint substitutes the value and quotes it in finding messages, which go to the log and to JSON and SARIF output. The worst target is /proc/self/environ, the linter's own environment. The Compose file only needs to reference the name of the first variable in it: because that file separates variables with NUL bytes rather than newlines, the sub…
Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
·GitHub Advisories
### Summary An attacker who can modify the attested workload’s code, memory-backed state, or configuration after the initial attestation — but without necessarily terminating the existing TLS connection — can cause the peer to continue trusting the connection as if the originally attested state were still running. ### Details Once attestation is successfully appraised and connection is established, there is a window of vulnerability from the establishment of connection to the termination of connection where an attacker can modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. Workload state includes code, data, and configuration. Other examples of state changes at the workload level include cases where a new device (such as a GPU) is connecte…
## Summary An unauthenticated (**Anonymous**) client can **Write** protected Variables and **Call** privileged Methods on any Node that lacks explicit per-node permissions. This follows the inheritance model defined by OPC UA Part 3, §5.2.9, where nodes without an explicit RolePermissions attribute inherit the namespace DefaultRolePermissions. OPC 10000-3 §4.8.3 mandates a **default-deny** evaluation (Bad_UserAccessDenied when the operation bits are not set); node-opcua instead **grants all permissions**. The root cause is a combination of an authorization **fail-open** and a **disconnect** between the configuration API and the runtime enforcement path. --- ## Affected configuration This advisory covers two cases that are not equally severe: 1. No RolePermissions declared anywhere…
gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments
·GitHub Advisories
## Summary gopacket decodes SCTP (IP protocol 132) by walking the chunk chain through per-chunk-type decoder functions (decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, in layers/sctp.go). Each of these reads fixed-size header fields and runs count-driven loops **without validating the chunk's declared length against the minimums those reads require**. A single crafted SCTP segment causes a runtime panic (out-of-bounds slice read, or inverted slice from unsigned length arithmetic) on any decode path that does not install gopacket's per-packet panic recovery (gopacket.DecodeOptions.SkipDecodeRecovery: true); with the default API the same input degrades to a per-packet decode error. The defect is present in every released version through v1.7.1 and at curre…
Dagu MCP DAG specification read bypasses path containment and workspace isolation
·GitHub Advisories
## Summary The traversal fix for CVE-2026-33344 was implemented as HTTP middleware installed only in the chi handler chain, but the MCP service calls the same API method in process, so arbitrary YAML file read is reachable again through the MCP tool surface with a viewer-role key. Read-only, limited to .yaml/.yml targets. Confirmed at HEAD f6c039f (post v2.10.7). ## The defect The fix for CVE-2026-33344 is a reflection-based HTTP middleware (internal/frontend/.../api.go, roughly lines 553-597) that inspects a request field named FileName and rejects anything that is not a plain name. It is installed in exactly one place: the chi strict-handler chain (api.go around line 419). The MCP service does not go through that chain. internal/service/mcp/server.go calls the API method directly as an…
Fireworks AI Breach Widens to Expose Customer Billing Data and Incomplete Model Weights
·The Hacker News
Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts." In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks
Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed
·The Hacker News
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix. A researcher who goes by forcequit released the escape, called worse_query, on Sunday, a
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in. After the alert The alert tells you something happened. However, gaining
Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities
·The Hacker News
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined. As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple
Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
·The Hacker News
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails. According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for
SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution
·The Hacker News
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server. The flaws in the Web
France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites
·The Hacker News
An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday. The attackers broke into controllers on the night of October 11 and changed their defrost settings to high temperatures. That caused food losses and, in at least 15 cases, fires. The unit
Anthropic's Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattack Benchmark
·The Hacker News
Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision. During pre-release training, the large language models (LLMs) helped its engineers "complete otherwise-infeasible software migrations, designed three working electronic devices from scratch, solved two open problems in the physics of black holes, made
Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
·The Hacker News
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component. Use-after-free bugs typically occur when a program attempts to access a memory location after
N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
·The Hacker News
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell. "As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
·The Hacker News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-123218 (CVSS score: 9.8) - An incorrect authorization vulnerability
Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses
·GitHub Advisories
## Summary The Kubeflow Pipelines frontend reflected untrusted pod names and namespaces into HTML error responses from the pod-information and pod-events routes. An attacker could craft a link that causes JavaScript to execute in the frontend's origin when a user follows it and reaches an affected error response. Affected routes include /pipeline/k8s/pod and /pipeline/k8s/pod/events (the deployment's configured base path may differ). ## Impact and prerequisites Successful exploitation requires a victim to open an attacker-supplied link and reach the vulnerable response. JavaScript execution may expose information accessible to the victim's browser or perform actions in the application's origin. The attacker does not need an account merely to construct and deliver the link. The victim…
Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server
·GitHub Advisories
## Summary Kubeflow Pipelines API server does not sufficiently validate SQL identifier fields decoded from the page_token pagination parameter. Client-controlled fields can reach SQL query construction, allowing SQL injection through list APIs. This advisory consolidates the original pipeline-listing report and the later run-listing report in [GHSA-mhpc-2x8q-2vp9](https://github.com/kubeflow/pipelines/security/advisories/GHSA-mhpc-2x8q-2vp9). Their contributions and chronology are distinguished below. ## Impact and prerequisites An attacker able to invoke an affected list API may read data accessible to the API server's database account, including data belonging to other namespaces. The original report demonstrated database read access through an authenticated Kubeflow deployment. Authe…
Kiwi TCMS account confirmation open redirect through protocol-relative URLs
·GitHub Advisories
## Summary In Kiwi TCMS version 16.1, the fix for CVE-2026-54724 (open redirect via unvalidated next parameter) in the account confirmation endpoint is incomplete. The validation uses startswith("/") to check if the redirect URL is local, but this is bypassed by protocol-relative URLs like //evil.com which start with / but redirect the browser to an external attacker-controlled domain. 16.1’s incomplete mitigation still allows protocol-relative destinations and earlier releases lack the mitigation. ## Vulnerable Code In tcms/kiwi_auth/views.py, the Confirm view (line ~113): def get_redirect_url(self, *args, **kwargs): self.url = self.request.GET.get("next", reverse("core-views-index")) if not self.url.startswith("/"): self.url = reverse("core-views-index") The check `startswit…
Microsoft Office: Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
·CISA KEV
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Openwave Messaging Limited Webtop Media Transcoder: Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
·CISA KEV
Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Cisco BroadWorks: Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
·CISA KEV
Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Barracuda Networks Barracuda Email Security Gateway (ESG): Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
·CISA KEV
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Google Chromium: Google Chromium Use-After-Free Vulnerability
·CISA KEV
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
·GitHub Advisories
## Summary In multi-user mode, the Kubeflow Pipelines API server skipped authorization checks for shared/global pipelines with an empty namespace. This exception applied to write and delete operations as well as reads, allowing an authenticated user to modify or delete shared pipelines without the required Kubernetes RBAC permissions. ## Impact Unauthorized modification compromises the integrity of shared pipeline definitions and versions. Unauthorized deletion can make shared pipelines unavailable. Execution of a modified pipeline can cause attacker-controlled workload behavior, but this is a conditional downstream consequence requiring the modified pipeline to be executed. Modification alone does not demonstrate immediate worker code execution. Reading shared pipelines is intentionally…
Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation
·GitHub Advisories
## Summary The Kubeflow Pipelines API server fetched caller-supplied pipeline package URLs without restricting the destination. A caller authorized to create a pipeline or pipeline version could cause requests to originate from the API server's network position, including to internal services that the caller could not otherwise reach. ## Impact The reported evidence demonstrates blind server-side request forgery and a limited status-code oracle. The fetched response is processed as a pipeline package; the report does not demonstrate arbitrary response-body disclosure or credential theft. A request to a cloud metadata endpoint returned HTTP 403, which does not establish access to metadata contents or tokens. The confidentiality metric is Low to reflect the limited information obtainable th…
Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)
·GitHub Advisories
## Summary The legacy Kubeflow Pipelines V1/raw-Argo execution cache does not separate cached results by Kubernetes namespace. In multi-user deployments where tenants share the cache service, a tenant can receive another tenant's cached outputs or seed outputs that are subsequently substituted into another tenant's step. This affects the Argo-template cache mutating webhook and its cache-server storage path. Standard KFP V2 component pods bypass this webhook cache; the separate V2 cache implementation is outside this advisory's scope. ## Affected deployments and impact The issue requires multiple tenant namespaces sharing the legacy cache service, cache-enabled V1/raw-Argo steps, and cache entries that satisfy the configured staleness policy. The standard multi-user configuration watches…
Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
·GitHub Advisories
Claude Code validated Edit tool targets using point-in-time pathname and symlink resolution that was not bound to the underlying directory inodes or file descriptors. On macOS, a process running inside Claude Code's Bash sandbox could exploit the resulting time-of-check to time-of-use window by atomically swapping an in-workspace parent directory with a symlink after validation completed, causing the unsandboxed Edit implementation to overwrite an attacker-selected user-writable file outside the workspace. Exploiting this required the ability to run attacker-controlled code inside the sandbox, such as through a malicious repository or dependency script. Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to…
croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive
·GitHub Advisories
## Summary croc is an end-to-end encrypted peer-to-peer file transfer tool. On the receiving side, the confirmation that normally protects an existing file from being overwritten or resumed is skipped whenever the received file's name starts with croc-stdin-, regardless of whether the incoming transfer is actually a text transfer. A sender can therefore name a file croc-stdin- and silently overwrite, truncate, or replace an existing file of that name in the receiver's working directory - including removing the existing file and substituting a symlink - without the Overwrite? prompt that the standard path requires. The exemption was introduced to keep croc's internal text-transfer artifacts from triggering prompts, but it is keyed on the filename prefix rather than on the transfer ty…
DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885
·GitHub Advisories
## Summary The CVE-2026-32885 ZipSlip fix added a symlink-target escape check to Untar, but the check rebases an ABSOLUTE symlink target into dest before validating (filepath.Join(dest, "/etc") stays lexically inside dest and passes), while the symlink is then created with the RAW absolute target via os.Symlink(file.Linkname, ...), so a malicious archive plants a host-absolute symlink and a following regular-file entry writes through it, restoring arbitrary host file create/overwrite (reaching $HOME rc-files, hence RCE). Confirmed at HEAD. ## The defect (the symlink check is a no-op for absolute targets) CVE-2026-32885 (fixed v1.25.2, commit 05cbe299) added a lexical containment check on the entry path and a NEW symlink-target validation. pkg/archive/archive.go, Untar, tar.TypeSymlink cas…
Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
·GitHub Advisories
### Summary The TCP transporter's packet parser (src/transporters/tcp/parser.js) reads the packet length field with Buffer.prototype.readInt32BE, a signed read. A crafted packet whose length field has the sign bit set yields a negative length. The parser then advances past the parsed message with packet = packet.slice(length), but Buffer.prototype.slice clamps an out-of-range negative start index to 0, so the buffer is returned unchanged. The while (packet.length > 0) loop condition therefore never becomes false, producing an infinite synchronous loop that blocks the Node.js event loop indefinitely. ### Impact Any Moleculer node using the TCP transporter can be rendered completely unresponsive by an unauthenticated remote peer sending a single ~10-byte crafted TCP packet, be…
Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin
·GitHub Advisories
## Summary The sql() VQL plugin runs a caller-supplied database driver and connection string with no permission check (vql/parsers/sql/sql.go:93, SQLPlugin.Call). For driver='mysql' or driver='postgres' the handle comes from GetHandleOther (sql.go:39), which passes the connection string straight to Go database/sqlsql.Open (sql.go:51) and executes the query (sql.go:159). The plugin declares FILESYSTEM_READ only as Info().Permissions metadata (sql.go:219). That metadata is never consulted at runtime: metadata.go:19 stores it as a string that only the documentation exporter reads (api/reflect.go:82-110). Every sibling network plugin (http_client, netcat, s3, rsyslog) calls CheckAccess(acls.NETWORK) in its own body; sql() calls nothing. The built-i…
Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
·GitHub Advisories
## Summary In multi-user mode, the Kubeflow Pipelines API server's HTTP multipart upload endpoints (POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version) perform no authorization when the target namespace is empty. The authorization helper canUploadVersionedPipeline returns nil, skipping SubjectAccessReview, whenever the resolved namespace is the empty string (backend/src/apiserver/server/pipeline_upload_server.go:401-403). An empty namespace is how KFP addresses shared, cluster-wide pipelines and is the default whenever the caller omits the namespace query parameter, because REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false and is unset in every shipped manifest. As a result, an arbitrary low-privilege tenant (or, when the API server is re…
FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files
·GitHub Advisories
## Summary POST /upload uses the request-supplied resumableFilename directly as a key into the shared temporary directory, without the character filter it applies to resumableIdentifier and without namespacing it per user. A valid user holding the upload permission can read any file in that directory into their own home directory, append to it, and delete it. This reproduces the cross-user batch-archive disclosure of GHSA-f74m-x83r-c4v4 through a different route — it still works with the fix for that advisory (PR #597) applied — and additionally allows deleting the login rate-limit lockfile. Reported with explicit preconditions and bounded impact, as before: the primitive is confined to the temporary directory, not the whole filesystem. ## Details - `backend/Controllers/UploadCont…
FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive
·GitHub Advisories
### Summary GET /batchdownload streams a batch ZIP to any requester who supplies its uniqid, without checking that the current user/session created it. In deployments where users have separate home directories, a valid low-privileged user who obtains an active archive id can download another user's batch archive, disclosing files the per-user boundary otherwise protects. Reported with explicit preconditions and bounded impact — not a universal "any user steals any file" issue. ### Details The archive id is generated with plain uniqid() and no ownership metadata is bound to it before streaming. - backend/Services/Archiver/Adapters/ZipArchiver.php:44 — createArchive() uses plain uniqid(). - backend/Controllers/DownloadController.php:144-145 — batchDownloadStart() reads the t…
A remote/local attacker who can get a symbolic link included in a source-code repository that code-graph-rag analyzes can cause the structural_search and structural_replace tools (backed by AstGrepService, exposed both as MCP tools and as agentic AI tools) to read and -- via structural_replace with dry_run=False -- overwrite arbitrary files outside the configured project root, because the tool's path-containment check (should_skip_path/_classify_file) is performed lexically on the unresolved path and never checks Path.is_symlink() or calls .resolve(), unlike the project's own (correct) validate_project_path decorator used elsewhere. Tested at commit 90a3ed3cbdc7d3bb8036985b851cc7c9a3ba9c57 (pyproject version 0.0.550), current main at test time. Confirmed this commi…
## Summary An authenticated Pocket ID user can request an email-verification token while their account uses an address they control, change the account email address, and then redeem the previously issued token. The token is bound only to the user ID, not to the address to which it was sent, and changing the address does not revoke outstanding tokens. As a result, Pocket ID marks the newly supplied address as verified even though the user never proved control of it. Pocket ID subsequently returns that address with email_verified: true in OIDC claims. A relying party that trusts this claim for email-based account linking or provisioning can therefore link the attacker's Pocket ID identity to a victim's existing account, leading to cross-application account takeover. This was verified aga…
Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)
·GitHub Advisories
### Summary The handle_short_request() function in urwid/display/web.py raises an unhandled UnicodeEncodeError when processing a POST request body containing non-ASCII bytes. The function reads POST input and encodes it to ASCII before writing to a named pipe. Any byte value above 0x7F causes the CGI process to exit with an unhandled exception, returning an HTTP 500 error to the client. Additionally, a file descriptor opened earlier in the same function is not closed before the exception propagates, causing a file descriptor leak for the lifetime of the CGI process. A second instance of missing exception handling exists in the polling update path, where non-UTF-8 socket output causes an unhandled UnicodeDecodeError. ### Impact An attacker who observes a valid X-Urwid-ID sessio…
### Summary The documented web.NewHandler static file server can read files outside Config.AppDir when the request path contains URL-encoded dot-segments such as %2e%2e. Go's ServeMux redirects plain /../ paths, but it passes encoded dot-segments to the handler after decoding r.URL.Path. The handler then calls filepath.Join(s.config.AppDir, r.URL.Path) without checking that the result remains under AppDir, allowing unauthenticated arbitrary file reads with the server process privileges. ### Details web/README.md:34-40 documents a network-facing setup: ``go http.Handle("GET /", web.NewHandler(web.Config{ AppDir: "/path/to/webapp", Fallback: "/index.html", Dev: false, })) log.Fatal(http.ListenAndServe(":8080", nil)) `` In web/handler.go:62-75, the handler takes `r.URL.…
fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution
·GitHub Advisories
## Summary fast-agent serve exposes the agent over MCP. By default it uses HTTP transport bound to 0.0.0.0 (all interfaces) on port 8000 with **no authentication** (auth=None) and prints no warning. Any host that can reach the port can call the exposed agent tool. When the server is started with --shell (which is -x, the flag used in the README quickstart uvx fast-agent mcp@latest -x), the agent has a local execute shell tool, so an unauthenticated remote client can drive the agent into running arbitrary OS commands — unauthenticated RCE. ## Affected code - cli/commands/serve.py — transport defaults to HTTP; --host defaults to 0.0.0.0; port 8000. - mcp/server/agent_server.py — auth_provider = None unless FAST_AGENT_SERVE_OAUTH=huggingface; `run_async(transport=…
Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets
·GitHub Advisories
## Summary Telepresence's Traffic Manager gRPC API (port 8081) requires no authentication. Any pod with cluster-network access to the Traffic Manager can register as a client in an arbitrary managed namespace and create intercepts against services in that namespace, regardless of Kubernetes RBAC. On interception the victim pod's complete container environment (secrets, tokens, API keys) is delivered to the attacker. Tested on HEAD v2.28.0, commit b2231a4. ## Details The gRPC server is started with no auth interceptor (pkg/grpc/server/server.go). The connection uses plaintext: grpc.WithTransportCredentials(insecure.NewCredentials()). ArriveAsClient stores the caller-supplied Namespace without verifying the caller is in that namespace. The only gate is whether the namespace is in the…
Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable
·GitHub Advisories
## Summary The Traffic Manager Tunnel gRPC streaming endpoint accepts a session ID from the first bytes of the client-controlled message payload. No verification confirms the caller owns the session. An attacker supplying a valid active session ID receives a fully routed tunnel for that session, gaining the network routing capabilities of the legitimate Telepresence client. Tested on HEAD v2.28.0, commit b2231a4. ## Details The Tunnel handler reads identity from a client-provided binary payload rather than from a verified credential or prior authenticated gRPC call: ```go // cmd/traffic/cmd/manager/service.go:1057-1063 func (s *service) Tunnel(server grpc.BidiStreamingServer[...]) error { stream, err := tunnel.NewServerStream(ctx, tunnel.ClientToManager, server) return s.state.Tunnel(…
zizmor: Debug logging prints available GitHub credentials in cleartext
·GitHub Advisories
### Summary zizmor 1.27.0 exposes GitHub access tokens in cleartext when debug-level logging is enabled. Tokens supplied via environment variables (GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN), or the corresponding command-line options (--gh-token, --github-token, --zizmor-github-token) are included in the debug representation of the parsed application configuration and written to stderr. The affected logging is enabled by a single -v/--verbose or an applicable RUST_LOG directive. ### Details The issue was introduced in commit [919bea46](https://github.com/zizmorcore/zizmor/commit/919bea4635bae204d5186e5743cb263c70b518b4), merged through [PR #2180](https://github.com/zizmorcore/zizmor/pull/2180). Version 1.26.1 and earlier are unaffected. Version 1.27.0 is the first…
ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header
·GitHub Advisories
### Summary A remote attacker from any IP address defeats the operator-configured source-IP allowlist (mcp_allowed_remote_ips / api_token_allowed_remote_ips) by sending a single X-Forwarded-For: header. The router is created with gin.New() and never calls SetTrustedProxies, so gin trusts every proxy by default and c.ClientIP() returns the attacker-supplied header verbatim. The same forged value is also written to Transaction.CreatedIp and the access log, so the attacker's real IP never appears in any record. ### Details cmd/webserver.go:104 builds the router with gin.New(). A grep of cmd/ and pkg/ confirms SetTrustedProxies is never called, leaving gin's default trusted-proxy range of 0.0.0.0/0 and ::/0. WebContext (pkg/core/context_web.go:39) embeds `*gin…
### Impact Host header injection risk when using Omniauth with a web framework that does not verify incoming host headers. An example of a framework that provides host header validation is modern Rails when [configured appropriately](https://guides.rubyonrails.org/v6.1.1/configuring.html#configuring-middleware) ### Patches 2.2.0 ### Workarounds _Set the full_host config in the Omniauth config_
Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization
·GitHub Advisories
### Summary ShadowCopyAction in the Shadow plugin does not validate or sanitize ZIP entry names before writing them to the output fat JAR. A malicious upstream dependency containing path traversal sequences (e.g. ../../../../tmp/pwned.txt) in entry names will have those entries reproduced verbatim in the output shadow JAR. ### Details The vulnerability exists because Shadow relies entirely on Gradle's ZipFileTree for entry sanitization rather than implementing its own path validation. This means: 1. Users on Gradle < 7.6.2 / 8.x < 8.2.0 are directly exploitable 2. The produced shadow JAR becomes a Zip Slip weapon against any downstream consumer using unprotected extraction (raw ZipInputStream, older CI tooling, custom Java unpackers) 3. If Shadow ever uses a non-ZipFileTree code path, p…
### Summary The read_file MCP tool in codebase_rag/mcp/tools.py contains a path traversal vulnerability in its paginated branch (when offset or limit is supplied). The handler constructs a file path using Path(self.project_root) / file_path without subsequently validating that the resolved path remains within the configured project root. Python's pathlib silently discards the left-hand component when the right-hand argument is an absolute path, allowing an attacker to read any UTF-8-readable file on the server by passing an absolute path such as /etc/passwd. ### Details **Vulnerable location:** codebase_rag/mcp/tools.py:556–565 (MCPToolsRegistry.read_file) The read_file MCP tool accepts three parameters: file_path, offset, and limit. When either offset or `limi…
Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment
·GitHub Advisories
### Summary Remark42 applied chi's middleware.RealIP globally, trusting True-Client-IP / X-Real-IP / X-Forwarded-For headers without verifying the request came from a trusted proxy. The per-IP rate limiters key on the overwritten r.RemoteAddr, so any client can bypass every per-IP rate limiter by rotating spoofed IP headers. The same spoofed IP also drives other per-IP controls (stored comment IP, anonymous identity derivation, and --votes-ip vote de-duplication). This affects deployments reachable directly from the internet (Remark42's built-in HTTP, static TLS, and ACME modes are all documented and supported), as well as any proxied deployment where the proxy forwards an attacker-controlled recognised header. ### Details The router applies middleware.RealIP globally, ahead…
Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
·GitHub Advisories
## Summary The client credentials grant (grant_type=client_credentials) does not validate the resource parameter before embedding it as the aud claim in the issued JWT. Any authenticated OIDC client can obtain a Pocket ID-signed access token claiming authorization for any arbitrary audience, including other registered OIDC clients. There is no check that the requested audience is a registered resource server, and no check that the requesting client has been granted permission to access it. ## Details In backend/internal/service/oidc_service.go, createTokenFromClientCredentials accepts the resource parameter from the token request and places it directly into the aud claim of the issued JWT without validation: ```golang audClaim := client.ID if input.Resource != "" { audClaim = inpu…
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
·GitHub Advisories
## Summary The HTTP mode of @tsparticles/mcp-server creates a single stateful StreamableHTTPServerTransport instance and reuses it for all clients. The first anonymous client that initializes the MCP endpoint claims the shared transport state, and later clients cannot create their own sessions. This was verified on v4.3.0 at commit 0266d469aa2d719cb66a9c6bf09aded4186ec17c. The same singleton transport pattern is still present in v4.3.1 and current main. ## Affected Code The server creates one shared transport before accepting requests: const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID(), }); const httpServer = createServer(async (req, res) => { ... await transport.handleRequest(req, res, parsedBody); }); Because the same transport objec…
tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process
·GitHub Advisories
## Summary The HTTP mode of @tsparticles/mcp-server parses incoming /mcp request bodies with JSON.parse() outside a request-local error boundary. A single malformed JSON request causes the async request handler to throw and terminates the Node.js process. This was verified on v4.3.0 at commit 0266d469aa2d719cb66a9c6bf09aded4186ec17c. Version 4.3.1 appears to fix this by returning HTTP 400 for invalid JSON. ## Affected Code The vulnerable handler is: if (req.method === "POST" && req.url === "/mcp") { const body = await new Promise((resolve, reject) => { const chunks: Buffer[] = []; req.on("data", (chunk) => chunks.push(Buffer.from(chunk))); req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8"))); req.on("error", reject); }); const parsedBody = body ? JSON.parse(bod…
JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS
·GitHub Advisories
## 1. Executive Summary JSON-java version 20260522 contains an unguarded path from an HTTP request body to unbounded BigInteger and BigDecimal construction. JSONTokener.nextSimpleValue() accumulates numeric characters into a StringBuilder with no length cap, then passes the full string to JSONObject.stringToNumber(), which calls new BigInteger(val) or new BigDecimal(val) directly. Both constructors have polynomial time complexity (O(n^1.585) for BigInteger). A 488 KB JSON body — well within nginx's default 1 MB body-size limit — contains a 500,000-digit numeric literal that blocks the handling thread for approximately 3 seconds. Spring Boot has no default size limit for application/json request bodies. No parser configuration option (withStrictMode, withKeepStrings)…
tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
·GitHub Advisories
### Summary The HTTP server mode of @tsparticles/mcp-server accumulates all incoming request body chunks into an in-memory Buffer[] array with no size limit before calling JSON.parse. An unauthenticated remote attacker can stream an arbitrarily large body to POST /mcp, exhausting the Node.js process memory and causing a Denial of Service. The official Docker image ships with HTTP mode enabled by default (--port 3000 on 0.0.0.0), making this exploitable without any special configuration in containerized deployments. ### Details The vulnerability exists in integrations/mcp-server/src/index.ts at lines 399–407. The POST /mcp request handler resolves a Promise that pushes every incoming data chunk into a Buffer[] array without checking the cumulative size, a `Content-Lengt…
ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)
·GitHub Advisories
### Summary The readPsd() function in ag-psd accepts a totalMemoryLimit option to cap memory usage when parsing untrusted PSD files, but this limit is never forwarded to the layer image buffer allocation path. A property name mismatch (totalMemoryLimit vs. memoryLimit) causes the size guard inside createImageDataBitDepth to be skipped unconditionally. An attacker who can supply a crafted PSD to any application using ag-psd for server-side parsing can force an unbounded heap allocation — a 5000×5000 layer in a 86-byte file allocates 200 MB — leading to denial of service through process memory exhaustion regardless of what limit the caller specified. ### Details readPsd() (exported from src/index.ts:22) wraps caller-supplied bytes in a PsdReader object that inherits `Rea…
zt-zip: ZipUtil.unpack can change file permissions of output directory
·GitHub Advisories
### Summary When using one of the ZipUtil.unpack overloads, the file permissions of the output directory can be changed. For example, when the output directory was only accessible to the 'owner' it could be instead made accessible to every OS user. ### Details When the name of a ZIP entry resolves to the output directory itself (e.g. the name /), the path traversal checks permit it and then perform actions on that directory, such as applying the file permissions of the ZIP entry to it. ### PoC This proof of concept requires an OS with support for POSIX file permissions. This issue itself is however not limited to those OS' with POSIX file permissions, see zt-zip's ZTFilePermissionsUtil.fetchDefaultStrategy which uses a fallback in that case. ```java // Uses Apache Commons Compress t…
traQ: Privilege escalation by OAuth prompt=none request
·GitHub Advisories
In OAuth2 silent authorization (prompt=none), when the scope parameter was empty or omitted, all scopes registered for the OAuth client became eligible for issuance. However, the prior consent check was performed against the empty requested scope set. As a result, an attacker could obtain an access token with broader scopes than the user had previously consented to, without requiring additional consent. ## Impact If an attacker controls an OAuth client capable of receiving authorization codes, and a user has already consented to only a subset of that client’s scopes, the attacker may be able to obtain a token containing all scopes registered for that client by sending an authorization request with prompt=none and an empty or omitted scope. If the user has not consented to the clie…
### Impact For instances where TRAQ_STORAGE_TYPE is set to local, the file retrieval API /files/{fileId} could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered directly in the browser. As a result, an attacker who can upload files to traQ could upload a crafted SVG or HTML file and trick a victim into opening the file URL, allowing the attacker to execute arbitrary JavaScript in the victim's browser. ### Patches This issue has been fixed in v3.28.3. After this fix, the file retrieval API always adds the Content-Disposition header to its responses regardless of the value of the dl query parameter. This prevents user-uploaded files from being displayed directly in the browser. ### Workarounds To mitigate the impact of this issue, apply either of the…
isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout
·GitHub Advisories
### Summary isomorphic-git's tree parser (src/models/GitTree.js) validates each entry name only against the path separators / and \. It does not reject the standalone reserved name .., so a malicious repository can, on a single clone/checkout, **write files outside the working directory** (unbounded depth). Works on any host-backed fs provider. ### Details The guard is: ``js // src/models/GitTree.js if (path.includes('\\') || path.includes('/')) { throw new UnsafeFilepathError(path) } `` The standalone string .. passes. isomorphic-git assembles the full path incrementally across tree levels, so nesting .. trees yields ../escaped.txt, ../../escaped.txt, … with unbounded depth (each level is a separate tree object that passes the per-entry guard). On checkout `mkdir(…
isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)
·GitHub Advisories
### Summary A malicious server can advertise circular symref= capabilities (e.g. a → b and b → a). isomorphic-git writes them to disk as loose symrefs, and GitRefManager.resolve() follows them with no depth limit and no cycle detection, so any later operation that resolves one of them (log, status, checkout, branch, …) **loops forever** — a persistent denial of service from a single clone. ### Details src/managers/GitRefManager.js — resolve() only enforces a depth limit when a depth argument is passed (depth = undefined by default), and has no visited-set: ``js static async resolve({ fs, gitdir, ref, depth = undefined }) { if (depth !== undefined) { depth--; if (depth === -1) return ref } … } `` updateRemoteRefs persists all server-supplied symrefs unconditiona…
isomorphic-git: Arbitrary file write outside of working tree via directory symlink during checkout (potential RCE)
·GitHub Advisories
### Summary git.checkout writes working-tree files through a directory **symlink** without checking the leading path, so a malicious repository can write **outside the intended working directory**. The defect is in isomorphic-git's checkout logic itself and is therefore **independent of the fs provider**. The *impact* depends on the configured filesystem; worst case is arbitrary file write on the host, e.g. injecting an attacker key into ~/.ssh/authorized_keys → remote login / code execution. ### Details A single git tree can't hold a name as both a symlink and a directory, so the attack uses two states: `` Commit N: config (mode 120000, symlink → ../.ssh) Commit N+1: config/ (mode 040000, tree) authorized_keys (mode 100644, attacker public key) `` Checking out commit N writes `co…
fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
·GitHub Advisories
### Summary fastapi-code-generator (koxudaxi) emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal (@app.get('/u//x')) without escaping the '. A ' in the path closes the decorator string and, via concatenation, injects a live expression that the decorator argument evaluates when main.py is imported (the ASGI server imports it at startup) -- code execution, no request needed. The path is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI. ### Details ``python @app.get('/u/'+(__import__("os").system('…') or "")+'/x', response_model=None) def get_thing() -> None: pass `` The generator post-processes output with black/isort, so a syntax-breaking payload aborts generation (DoS); a valid-Python concat (`'+expr+…
### Summary fastapi-code-generator (koxudaxi) emits an operation's extra responses into the route decorator's responses={...} dict, using each response's status-code key as a single-quoted string literal without escaping the '. A ' in a status-code key closes the dict-key string and, via concatenation, injects a live expression that the decorator argument evaluates when main.py is imported (the ASGI server imports it at startup) -- code execution, no request. The status-code key is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI. ### Details ``python @app.get( '/u', response_model=None, responses={ '404' + (__import__("os").system('…') or "") + 'x': {'model': Thing} }, ) def get_thing() -> None: pass `` The responses={...} dict is emitted only when the o…
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
·GitHub Advisories
### Summary fastapi-code-generator (koxudaxi) emits an operation's summary as the generated route handler's docstring, using a triple-quoted string without escaping """. A """ in the summary closes the docstring and, via concatenation, injects a live expression that becomes an expression statement in the handler body -- which runs when the route handler is CALLED (the endpoint is hit). The summary is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI. ### Details ``python def get_thing() -> None: ( """ x""" + (__import__("os").system('…') or "") + """y """ ) pass `` The generator post-processes with black/isort, so a syntax-breaking payload aborts generation; a valid-Python breakout ("""+expr+""", kept valid with (… or "")) is written and executes…
### Summary ZipUtil.unpack(...) rejects ZIP entries that escape the target output directory, but the Zips fluent API appears to use a separate unpack implementation that does not apply the same destination-boundary check. A ZIP entry such as: ``text ../escape/poc.txt `` is written outside the configured destination directory when processed with: ``java Zips.get(zip).unpack().destination(outputDir).process(); `` The transformer branch is affected as well. ### Tested Version commit: 067935dca375500d3ff025aafcdf0e4283931b1a ### Root Cause In src/main/java/org/zeroturnaround/zip/Zips.java, Zips.UnpackingCallback.process(...) builds the output file directly from the ZIP entry name: ``java String entryName = zipEntry.getName(); File file = new File(destination, entryName); `` The…
Logging Redactor: PII data in str/repr of non primitive objects was not being redacted
·GitHub Advisories
Impact PII data in str/repr of non primitive objects was not being redacted, leading to leakage of PII in logs that should have been redacted for custom __str__ and __repr__ functions Patches The problem has been patched in version 0.0.7. Workarounds None without patching.
Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data
·The Hacker News
An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today. The attacker used credentials for an AWS account that Qubole's platform uses to reach those customers. How the attacker got those credentials has not been disclosed. Qubole, a data lake platform owned by Idera,
Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware
·The Hacker News
Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2. Both releases download and run code built to steal the wallet key that Swarm Desktop keeps for its node, along with the stored password that unlocks it. The code is also built to install a backdoor
Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia
·The Hacker News
The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT. "PapRAT has both C++ and Rust implementations," Fortinet FortiGuard Labs researcher Cara Lin said. "Its capabilities include command execution, file
⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More
·The Hacker News
A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become part of the attack. Elsewhere, attackers are hiding inside normal web traffic, stealing credentials from network devices, and finding new uses for exposed
Cloudflare is distributing the first $301,300 of the Vite Ecosystem Fund to open source projects and maintainers. The recipients were chosen by a panel of Vite stack core team members, including maintainers not employed by Cloudflare.
Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
·The Hacker News
The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine. Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an
Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety
·The Hacker News
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the wallets, both companies said late last week. Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker
LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks
·The Hacker News
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday. It has several security fixes to release and asked operators to be careful until they are out. One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could
Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records
·The Hacker News
A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis's Threat Research Unit said last week. The agents also found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video footage, without a login. The researchers are highly confident that the attacker is a single person