lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content

SummaryThe LightRAG WebUI renders assistant/answer chat content as raw HTML — react-markdown isconfigured with rehypePlugins=rehypeRaw and skipHtml=false and no HTML sanitizerrehype-sanitize, element allow-list, or custom urlTransform. Because answer content is derivedfrom user-ingested documents...

MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

Summarymakessrfsafehook blocks HTTP redirects to private/internal IPs by validating the Location header before the client follows a 3xx response. The problem is that this hook is only attached in one of three authentication branches — the header-PAT path. Basic auth and OAuth branches skip it...

PYSEC-2026-4085 MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

Summary makessrfsafehook blocks HTTP redirects to private/internal IPs by validating the Location header before the client follows a 3xx response. The problem is that this hook is only attached in one of three authentication branches — the header-PAT path. Basic auth and OAuth branches skip it...

LiteLLM: M2M JWT Handler Has Improper Authorization

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/userapikeyauth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is...

Custom-Metasploit-Modules

Custom Metasploit Modules This repository contains custom Metasploit modules created for educational and recreational purposes. Table of Contents Modules Loading Modules in Metasploit Usage Contribution Disclaimer Modules Below is a list of custom Metasploit modules available in this repository:...

CVE-2026-94220

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

CVE-2026-94212

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

CVE-2026-94220

A Cross-Site request forgery (CSRF) vulnerability exists in the feishu-auth and dingtalk-auth plugins within Apache APISIX (versions 3.17.0 through 3.18.0 ). This flaw allows an attacker to trick a user into clicking a crafted link, causing the user's browser session on a protected route to be es...

CVE-2026-94220 Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

EUVD-2026-90766

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

CVE-2026-94220 Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

CVE-2026-94212 Apache APISIX: unauthenticated impersonation issue in saml-auth

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

CVE-2026-94212

Apache APISIX versions 3.17.0 through 3.18.0 are vulnerable to an improper verification of cryptographic signature flaw within the saml-auth plugin. Under default configurations, an unauthenticated attacker can exploit this to impersonate any user across every route protected by the plugin. To re...

EUVD-2026-90765

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

CVE-2026-94212 Apache APISIX: unauthenticated impersonation issue in saml-auth

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

BIT-RABBITMQ-2026-67234 RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the...

BIT-RABBITMQ-2026-67230 RabbitMQ: Web-STOMP unbounded pre-auth accumulation

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither maxframesize nor logintimeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frame...

BIT-RABBITMQ-2026-66069 RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...

CLEANSTART-2025-UQ49615 Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability

Security vulnerability affects the exim package. Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability...

PT-2026-105840

Summary make ssrf safe hook blocks HTTP redirects to private/internal IPs by validating the Location header before the client follows a 3xx response. The problem is that this hook is only attached in one of three authentication branches — the header-PAT path. Basic auth and OAuth branches skip it...