GHSA-V75V-6FPF-GVW8 Vitess vttablet /twopcz reflected XSS

From: xylove21 To: [email protected] Subject: Security Report Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800 Summary The twopczHandler in go/vt/vttablet/tabletserver/twopcz.go line 185 reflects the Action and dtid form values directly into the HTML response body via...

Vitess vttablet /twopcz reflected XSS

From: xylove21 To: [email protected] Subject: Security Report Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800 Summary The twopczHandler in go/vt/vttablet/tabletserver/twopcz.go line 185 reflects the Action and dtid form values directly into the HTML response body via...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in fast-uri (CVE-2026-84292, CVE-2026-84394)

Summary IBM Db2 Developer Extension is affected by vulnerability in fast-uri CVE-2026-84292, CVE-2026-84394 Vulnerability Details CVEID:CVE-2026-84292 DESCRIPTION: fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host componen...

GHSA-P6WJ-QRR4-PGH5 kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

Summary A nil-pointer dereference in openapi3filter lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI 3.1 operation that declares type: array without items. OpenAPI 3.1 JSON Schema 2020-12 permits omitting items, and doc.Validate accepts such...

kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

Summary A nil-pointer dereference in openapi3filter lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI 3.1 operation that declares type: array without items. OpenAPI 3.1 JSON Schema 2020-12 permits omitting items, and doc.Validate accepts such...

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Summary Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with n...

GHSA-54MM-6729-R5WP Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Summary Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with n...

GHSA-V3PH-CGQH-R8P5 FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

Summary In worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP's session extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting Cookie: session=A can have sessionid resolve to ...

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

Summary In worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP's session extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting Cookie: session=A can have sessionid resolve to ...

MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

Summary In affected versions, a Streamable HTTP server in stateful mode the default never reclaimed session state: - sessions did not expire; - a client DELETE ended the session but left its entry registered; - a session whose first request was refused stayed registered with a running task. Each...

GHSA-84M7-P3X7-PCFV MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

Summary In affected versions, a Streamable HTTP server in stateful mode the default never reclaimed session state: - sessions did not expire; - a client DELETE ended the session but left its entry registered; - a session whose first request was refused stayed registered with a running task. Each...

GHSA-GFRC-G87H-7H5W Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Summary Endpoints that bind a TOTP secret POST /api/otpenroll or register a WebAuthn passkey POST /api/finishpasskeyregister for the current user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered outside the RequireSecureSession group. With...

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Summary Endpoints that bind a TOTP secret POST /api/otpenroll or register a WebAuthn passkey POST /api/finishpasskeyregister for the current user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered outside the RequireSecureSession group. With...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in js-yaml (CVE-2026-84375)

Summary IBM Db2 Developer Extension is affected by vulnerability in js-yaml CVE-2026-84375 Vulnerability Details CVEID:CVE-2026-84375 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.j...

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Summary internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and...

GHSA-76PM-MQ2Q-9GCR Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Summary internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and...

Security Bulletin: IBM Sterling Connect:Direct for Unix is impacted by a vulnerability

Summary The statistics file archive feature is used by IBM Sterling Connect:Direct for UNIX to automatically archive statistics files. IBM Sterling Connect:Direct for UNIX is impacted by a vulnerability in the statistics file archive feature. IBM Sterling Connect:Direct for UNIX has been updated ...

Security Bulletin: IBM Disconnected Log Collector contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Disconnected Log Collector has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-27727 DESCRIPTION: mchange-commons-java, a...

Security Bulletin: IBM Cognos Command Center has addressed vulnerabilities

Summary There are vulnerabilities in IBM Cognos Command Center. IBM Cognos Command Center 10.2.5 FP1 IF5 has addressed the applicable CVEs. Please refer to the table in the Related Information section for vulnerability impact. Vulnerability Details CVEID:CVE-2026-14963 DESCRIPTION: IBM Cognos...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by an Allocation of Resources Without Limits or Throttling Vulnerability in Netty (CVE-2026-93491)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD as part of the agent communication system. CVE-2026-93491 Vulnerability Details CVEID:CVE-2026-93491 DESCRIPTION: A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by...