vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

Summary The /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects and postprocess every nested choices.tokenids list directly. Unlike the normal render/generate path, derender does not enforce model context length, resolved maxtokens,...

GHSA-8737-QX52-HJFF vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

Summary The /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects and postprocess every nested choices.tokenids list directly. Unlike the normal render/generate path, derender does not enforce model context length, resolved maxtokens,...

tailsnitch v1.7

Tailsnitch A security auditor for Tailscale configurations. Tailsnitch scans your tailnet for 57 misconfigurations, overly permissive access controls, and security best practice violations. Quick Start root@kitploit: 1. Set your Tailscale API credentials export TSAPIKEY="tskey-api-..." 2. Run aud...

GHSA-MP7R-57W4-5QM3 SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password

CVE: This vulnerability corresponds to CVE-2026-72792. Summary /api/tag/getTag filters its results for reader roles through FilterTagsByPublishIgnore, which checks only the visible publish tier. Documents that are published but password-protected pass that check, so a reader who has never entered...

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password

CVE: This vulnerability corresponds to CVE-2026-72792. Summary /api/tag/getTag filters its results for reader roles through FilterTagsByPublishIgnore, which checks only the visible publish tier. Documents that are published but password-protected pass that check, so a reader who has never entered...

CVE-2026-75925 IXON VPN Client CRLF Injection

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being...

CVE-2026-75925 IXON VPN Client CRLF Injection

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being...

CVE-2026-75925

IXON VPN Client versions prior to 1.4.7 contain a CRLF injection vulnerability (CWE-93, with contributing CWE-306) that enables remote code execution with root or SYSTEM privileges . The local configuration service accepts changes without authenticating the requester and writes values to a file l...

GHSA-GX45-XRJ5-G6C4 CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

EUVD-2026-60970

CodeWhale: Argument Injection in gitblame Tool Allows Arbitrary File Read Without Approval...

GHSA-C6MW-8XH8-GPQ6 CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

NPM: CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

NPM: CodeWhale: Argument Injection in gitblame Tool Allows Arbitrary File Read Without Approval vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.3.27, 0.8.41...

NPM: CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

NPM: CodeWhale: Argument Injection in gitblame Tool Allows Arbitrary File Read Without Approval vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...

Exploit for CVE-2026-85769

CVE-2026-85769 Heap out-of-bounds read in libtpms TPM 2.0...

NPM: CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval

NPM: CodeWhale: Argument Injection in gitshow Tool Allows Arbitrary File Write Without Approval vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.3.27, 0.8.41...

NPM: CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval

NPM: CodeWhale: Argument Injection in gitshow Tool Allows Arbitrary File Write Without Approval vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...

EUVD-2026-60971

CodeWhale: Argument Injection in gitshow Tool Allows Arbitrary File Write Without Approval...

GHSA-7J5W-7R7X-9V27 CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is...