GHSA-M675-2P33-XV9G Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

Summary The FastCGI transport's splitPos in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treatin...

IT threat evolution in Q1 2026. Non-mobile statistics

IT threat evolution in Q1 2026. Non-mobile statistics IT threat evolution in Q1 2026. Mobile statistics The statistics in this report are based on detection verdicts returned by Kaspersky products unless otherwise stated. The information was provided by Kaspersky users who consented to sharing...

CVE-2026-8785

creationtimestamp| type| source ---|---|--- 2026-05-18 06:37:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4b7i5vqd2h 2026-05-18 06:52:58+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mm4c3nhqcd2w...

CVE-2026-8776

creationtimestamp| type| source ---|---|--- 2026-05-18 01:30:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mm3q346myt2v 2026-05-18 01:30:34+00:00| seen| https://infosec.exchange/users/offseq/statuses/116592989309624683 2026-05-18 03:00:46+00:00| seen|...

PT-2026-41730

Name of the Vulnerable Software and Affected Versions Claude HUD versions 0.0.0 through 0.0.12 Description The software constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping control characters or encoding embedded values. This allows attackers t...

The vulnerability of the path Resolve() function in the vm2 library of the NPM package manager allows a attacker to bypass the sandbox protection and execute arbitrary code.

The vulnerability of the pathResolve function in the vm2 library of the NPM package manager is related to an incorrect definition of symbolic links during file access. Exploiting this vulnerability allows a remote attacker to bypass the sandboxing mechanisms and execute arbitrary code...

PT-2026-41724

Name of the Vulnerable Software and Affected Versions Summarize versions prior to 0.15.1 Description The hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links. This causes the extension to make authenticated daemon requests using stored...

cramfs-tools 后置链接漏洞

cramfs-tools is a compression read-only file system tool developed by Nicolas Pitre. Versions of cramfs-tools prior to 2.2 had a post-installation link vulnerability. This vulnerability stemmed from the operation of the changefilestatus function in the cramfsck.c file, which allowed symbolic link...

Mattermost 代码问题漏洞

Mattermost is an open-source collaboration platform developed by the American company Mattermost. Versions of Mattermost such as 11.5.1 and earlier 11.5.x series as well as 10.11.13 and earlier 10.11.x series have code vulnerabilities. These vulnerabilities stem from the lack of validation of the...

The vulnerability of Nomad application orchestrators, related to incorrect definition of symbolic links before accessing files, allows attackers to gain read and write access to arbitrary files.

The vulnerability of Nomad application orchestrators is related to the incorrect definition of symbolic links before accessing files. Exploiting this vulnerability allows an attacker to gain access to and read/write arbitrary files...

The vulnerability of the Apache Tomcat application server arises from the redirection of URLs to an unreliable website, allowing attackers to redirect users to arbitrary URL addresses.

The vulnerability of the Apache Tomcat application server is related to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary URL addresses...

CVE-2017-9313

creationtimestamp| type| source ---|---|--- 2026-05-17 15:23:15+00:00| seen| https://gist.github.com/dohyun4455/0153f5bf20c868cd82dca3e99a9e70a4 2026-05-17 15:23:17+00:00| seen| https://gist.github.com/dohyun4455/6da8ff9f0cecd699ca89b6d71654b71f 2026-05-17 15:25:44+00:00| seen|...

CVE-2026-8724

creationtimestamp| type| source ---|---|--- 2026-05-17 04:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlzjnxg65o2y 2026-05-17 04:30:45+00:00| seen| https://infosec.exchange/users/offseq/statuses/116588034576668128 2026-05-17 04:52:33+00:00| seen|...

Path Traversal

zrok is vulnerable to Path Traversal. The vulnerability is due to failure to prevent symlink traversal in the WebDAV drive backend, which allows a remote attacker to access symbolic links pointing outside the shared root and read or, where permitted, modify arbitrary files on the host filesystem...

GHSA-WJ3Q-VW2V-3RJ3 Duplicate Advisory: phpMyFAQ: SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-whqh-9pq5-c7r3. This link is maintained to preserve external references. Original Description phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities that...

Duplicate Advisory: phpMyFAQ: SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-whqh-9pq5-c7r3. This link is maintained to preserve external references. Original Description phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities that...

CVE-2026-46360

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQEDIT permission can upload malicious SVG files with deeply...

CVE-2026-45037

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted termina...

CVE-2026-45037

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted termina...

CVE-2026-45539 Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree

Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob / Path.rglob calls and read each match with Path.readtext, transparently following symbolic links. A symlink...