831119 matches found
OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
Summary When cache interception is enabled, @opennextjs/cloudflare can interpret percent-encoded paths differently during middleware matching and cache lookup. An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached respon...
EUVD-2026-101303
Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant...
GHSA-QJPP-GFFX-2WM9 Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant
Summary A single low-privilege RoleMember can take the entire Nezha dashboard offline, and with it every tenant's web UI, REST API, and agent connections, by racing two ordinary operations on their own service. The crash is a nil pointer dereference in the service-monitor worker at...
Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant
Summary A single low-privilege RoleMember can take the entire Nezha dashboard offline, and with it every tenant's web UI, REST API, and agent connections, by racing two ordinary operations on their own service. The crash is a nil pointer dereference in the service-monitor worker at...
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
Summary A nil-pointer dereference in openapi3filter lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI 3.1 operation that declares type: array without items. OpenAPI 3.1 JSON Schema 2020-12 permits omitting items, and doc.Validate accepts such...
GHSA-P6WJ-QRR4-PGH5 kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
Summary A nil-pointer dereference in openapi3filter lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI 3.1 operation that declares type: array without items. OpenAPI 3.1 JSON Schema 2020-12 permits omitting items, and doc.Validate accepts such...
EUVD-2026-98850
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods...
GHSA-54MM-6729-R5WP Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
Summary Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with n...
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
Summary Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with n...
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
Summary In worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP's session extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting Cookie: session=A can have sessionid resolve to ...
GHSA-V3PH-CGQH-R8P5 FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
Summary In worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP's session extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting Cookie: session=A can have sessionid resolve to ...
EUVD-2026-98911
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module...
EUVD-2026-98780
SFTPGo: Denial of service via malformed SSH channel request...
GHSA-Q7PC-356P-HGGC SFTPGo: Denial of service via malformed SSH channel request
Summary A flaw in the SSH service allows an authenticated client to crash the server by sending a malformed protocol message while opening a channel. Impact Any user able to authenticate over SSH can trigger an unhandled error condition that aborts the server process. This results in a denial of...
SFTPGo: Denial of service via malformed SSH channel request
Summary A flaw in the SSH service allows an authenticated client to crash the server by sending a malformed protocol message while opening a channel. Impact Any user able to authenticate over SSH can trigger an unhandled error condition that aborts the server process. This results in a denial of...
GHSA-VC32-4GWF-77XP Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcpmessage using only ordinary authentication. Details The HTTP configuration mutation surface is explicitly...
EUVD-2026-97907
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools...
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcpmessage using only ordinary authentication. Details The HTTP configuration mutation surface is explicitly...
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
Summary Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again. Details GenerateShortToken creates an AuthTok...
GHSA-WQ4W-VWVQ-Q3X9 Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
Summary Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again. Details GenerateShortToken creates an AuthTok...