Instatic-Stored-XSS-CVE-2026-103931

URL scheme filter bypass in isSafeUrl via leading C0 control characters Affected: Instatic v0.0.13 / commit 63ad5d6 and all earlier revisions containing src/core/html-sanitize/index.ts Component: src/core/html-sanitize/index.ts → isSafeUrl / safeUrl Class: CWE-79 Stored XSS via CWE-184 Incomplete...

afterimage

Afterimage Created and maintained bySergio Rodriguez SSH-PuR66. The experiment harnesses and analysis are mine; the published vulnerabilities, urllib3 code, and upstream fixes retain their original attribution. Author’s research method · Redirect harness · Chunk-framing study Read the patch...

river

River is a Python library for online machine learning. It aims to be the most user-friendly library for doing machine learning on streaming data. River is the result of a merger between creme and scikit-multiflow. ⚡️ Quickstart As a quick example, we'll train a logistic regression to classify the...

o1js-scan

o1js-scan Community package: o1js-scan is listed in the official o1js Community Packages directory. Latest: 0.22.0 — a local MCP server lets Claude Code, Cursor and other AI coding assistants run the scanner while you write a zkApp: pip install 'o1js-scanmcp'. It runs on your machine over stdio a...

rtl8812au

RTL8812AU/21AU and RTL8814AU Wireless drivers Only for use with Linux & Android THESE DRIVERS IS DEPRECATED. Use the mac80211 drivers over at https://github.com/lwfinger/rtw88 Important! Use "ip" and "iw" instead of "ifconfig" and "iwconfig" It's described further down, READ THE README! Note: The...

D-Scan

When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse Official implementation of SIGIR 2026 paper When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse. D-SCAN is an analysis framework for detecting document poisoning attacks in RAG...

GHSA-6PQ8-JHM2-2VCW qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

Summary qs.stringifyobj, arrayFormat: 'comma' throws an uncaught TypeError: Cannot convert object to primitive value when an array in obj contains an element that carries an own, non-callable toString property for example a: toString: 'x' . A remote, unauthenticated attacker who can influence an...

GHSA-QQ8J-7V2V-3RWP undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

Impact undici's experimental WebSocket client enabled by default via allowH2: true crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort ...

anomaly-flow

Anomaly-Flow Framework for implementing Intrusion Detection Systems NIDS aimed at identifying anomalies in network flows using Machine Learning models. Reference paper: Anomaly-Flow: A Multi-domain Federated Generative Adversarial Network for Distributed Denial-of-Service Detection Create the...

Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

Report metadata | Field | Value | | --- | --- | | Package | authlib PyPI, pkg:pypi/authlib | | Repository | https://github.com/authlib/authlib | | Component | authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest | | Vulnerability class | Authorization bypass: a...

GHSA-Q686-2QMG-HQC7 Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

Report metadata | Field | Value | | --- | --- | | Package | authlib PyPI, pkg:pypi/authlib | | Repository | https://github.com/authlib/authlib | | Component | authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest | | Vulnerability class | Authorization bypass: a...

GHSA-2PHH-27FW-Q4GC PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Summary PhpSpreadsheet's Worksheet\Drawing::setPath validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with filegetcontents using a stream context that does not set followlocation = 0. A whitelisted host that returns ...

PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Summary PhpSpreadsheet's Worksheet\Drawing::setPath validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with filegetcontents using a stream context that does not set followlocation = 0. A whitelisted host that returns ...

GHSA-3633-R77Q-H3V3 Datadog dd-trace-py: ReDoS in URL query string obfuscation

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

Datadog dd-trace-py: ReDoS in URL query string obfuscation

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

GHSA-P3M5-H5V9-VQJ6 Datadog dd-trace-py: IAST instrumentation can lead to application DOS

Summary A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. Details The affected IAST string-processing...

Datadog dd-trace-py: IAST instrumentation can lead to application DOS

Summary A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. Details The affected IAST string-processing...

GHSA-H3RC-6MM3-GC2M vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

Summary An untrusted multimodal request can set mmprocessorkwargs.coderevision. When vLLM serves a model whose Hugging Face processor uses dynamic automap code and the operator enabled --trust-remote-code, this request value reaches AutoProcessor.frompretrained and selects the Python revision...

vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

Summary An untrusted multimodal request can set mmprocessorkwargs.coderevision. When vLLM serves a model whose Hugging Face processor uses dynamic automap code and the operator enabled --trust-remote-code, this request value reaches AutoProcessor.frompretrained and selects the Python revision...

ike-scan

ike-scan Discover and fingerprint IKE hosts IPsec VPN Servers Table of Contents Building and Installing Overview Usage Implementation Details Host Input and Memory Requirements Rate Limiting Cookie Generation and Remote Host Identification IKE Packet Details Backoff Fingerprinting Program Output...