PT-2026-99160

Summary Nezha v2.2.3 regresses the GHSA-9rc6-8cjv-rcvx host header injection fix for deployments where the new dashboard host setting is empty. In that configuration, /api/v1/oauth2/provider again reflects the request Host header into the OAuth2 redirect uri sent to the identity provider, even if...

CRLF Injection

Overview ci4-cms-erp/ci4ms is a composer create-project ci4-cms-erp/ci4ms Affected versions of this package are vulnerable to CRLF Injection via the host parameter in the install controller, which is not validated for newline characters before being written to the .env file. An attacker can injec...