164398 matches found
Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
Summary diohttp2adapter follows HTTP Location redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin 302 redirect receives the victim's Authorization, Cookie, and Proxy-Authorizatio...
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
Summary openapi3filter decodes deepObject-style query parameters by looping over every key in the request's query string. Inside that loop it recompiles a loop-invariant regular expression on every iteration. The pattern depends only on the spec-defined parameter name, not on the loop variable, s...
GHSA-H4R5-MXV5-8MJC kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
Summary openapi3filter decodes deepObject-style query parameters by looping over every key in the request's query string. Inside that loop it recompiles a loop-invariant regular expression on every iteration. The pattern depends only on the spec-defined parameter name, not on the loop variable, s...
CVE-2026-109841
A flaw was found in undici. The HTTP client improperly handles case sensitivity when verifying Subresource Integrity SRI algorithm tokens. When an application specifies an uppercase or mixed-case algorithm name, undici treats the token as unrecognized and skips verification instead of enforcing i...
Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in undici (CVE-2026-18149, CVE-2026-18540, CVE-2026-19534, CVE-2026-84890, CVE-2026-84933, CVE-2026-84947, CVE-2026-84961, CVE-2026-85008, CVE-2026-85014, CVE-2026-85024)
Summary IBM Db2 Developer Extension is affected by vulnerability in undici CVE-2026-18149, CVE-2026-18540, CVE-2026-19534, CVE-2026-84890, CVE-2026-84933, CVE-2026-84947, CVE-2026-84961, CVE-2026-85008, CVE-2026-85014, CVE-2026-85024 Vulnerability Details CVEID:CVE-2026-18149 DESCRIPTION: undici'...
GHSA-V75V-6FPF-GVW8 Vitess vttablet /twopcz reflected XSS
From: xylove21 To: [email protected] Subject: Security Report Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800 Summary The twopczHandler in go/vt/vttablet/tabletserver/twopcz.go line 185 reflects the Action and dtid form values directly into the HTML response body via...
Vitess vttablet /twopcz reflected XSS
From: xylove21 To: [email protected] Subject: Security Report Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800 Summary The twopczHandler in go/vt/vttablet/tabletserver/twopcz.go line 185 reflects the Action and dtid form values directly into the HTML response body via...
Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in fast-uri (CVE-2026-84292, CVE-2026-84394)
Summary IBM Db2 Developer Extension is affected by vulnerability in fast-uri CVE-2026-84292, CVE-2026-84394 Vulnerability Details CVEID:CVE-2026-84292 DESCRIPTION: fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host componen...
GHSA-P6WJ-QRR4-PGH5 kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
Summary A nil-pointer dereference in openapi3filter lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI 3.1 operation that declares type: array without items. OpenAPI 3.1 JSON Schema 2020-12 permits omitting items, and doc.Validate accepts such...
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
Summary A nil-pointer dereference in openapi3filter lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI 3.1 operation that declares type: array without items. OpenAPI 3.1 JSON Schema 2020-12 permits omitting items, and doc.Validate accepts such...
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
Summary Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with n...
GHSA-54MM-6729-R5WP Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
Summary Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with n...
GHSA-V3PH-CGQH-R8P5 FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
Summary In worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP's session extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting Cookie: session=A can have sessionid resolve to ...
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
Summary In worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP's session extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting Cookie: session=A can have sessionid resolve to ...
GHSA-84M7-P3X7-PCFV MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
Summary In affected versions, a Streamable HTTP server in stateful mode the default never reclaimed session state: - sessions did not expire; - a client DELETE ended the session but left its entry registered; - a session whose first request was refused stayed registered with a running task. Each...
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
Summary In affected versions, a Streamable HTTP server in stateful mode the default never reclaimed session state: - sessions did not expire; - a client DELETE ended the session but left its entry registered; - a session whose first request was refused stayed registered with a running task. Each...
GHSA-GFRC-G87H-7H5W Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
Summary Endpoints that bind a TOTP secret POST /api/otpenroll or register a WebAuthn passkey POST /api/finishpasskeyregister for the current user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered outside the RequireSecureSession group. With...
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
Summary Endpoints that bind a TOTP secret POST /api/otpenroll or register a WebAuthn passkey POST /api/finishpasskeyregister for the current user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered outside the RequireSecureSession group. With...
Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in js-yaml (CVE-2026-84375)
Summary IBM Db2 Developer Extension is affected by vulnerability in js-yaml CVE-2026-84375 Vulnerability Details CVEID:CVE-2026-84375 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.j...
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
Summary internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and...