CVE-2026-117574 Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials fr...

CVE-2026-117574 Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials fr...

GHSA-R7W9-592Q-9VG4 Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Summary The MethodOverride middleware accepts any non-empty string as the override target method — including safe methods GET, HEAD, OPTIONS, TRACE — when rewriting a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain e.Use, it rewrites the request...

GHSA-99JH-6H7P-PP36 Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Summary The Echo proxy middleware middleware/proxy.go preserves an incoming X-Real-IP header verbatim and forwards it to the upstream service when EchoIPExtractor is not configured — which is the default. Because any HTTP client can supply an arbitrary X-Real-IP value, an attacker can cause Echo ...

GHSA-4MFG-R38W-W8FG mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6

URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 Summary mcp-sanitizer v1.3.3 fails to block Server-Side Request Forgery SSRF targets when a localhost URL includes an explicit port e.g., http://localhost:8080/ or when an IPv6 loopback/link-local address...

GHSA-7W82-6F9J-V9JP mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

File Path Sanitizer Permits Arbitrary User-Home Absolute Paths Summary mcp-sanitizer v1.3.3 explicitly whitelists /home/ and /Users/ as allowed absolute path prefixes in its file path validation logic src/utils/validation-utils.js:188-196. As a result, paths such as /home/alice/.ssh/idrsa and...

GHSA-5J9R-FX4X-RPVG rucio has an Authorization Bypass on REST API endpoint for signing URLs

Summary The /credentials/signurl endpoint decides authorization from the client-supplied X-Rucio-Account HTTP header instead of the authenticated token's account. Any client holding any valid auth token even a low-privilege account they legitimately own can send X-Rucio-Account: root to pass the...

GHSA-473Q-M89C-GHF8 MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)

Summary With SslMode set to VerifyCA or VerifyFull with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g.,...

GHSA-8QX7-J2V2-X6Q5 Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

AI Disclosure This vulnerability was discovered via deepseek-v4-pro1m for finding potential vulnerabilities / inconsistencies in the code base. I made the AI check if Caddy is compliant with various RFCs, incl. 7230. I also used it to help write the PoC, since it was honestly much faster than...

CVE-2026-118651 Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

CVE-2026-118651 Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

EUVD-2026-112406

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

CVE-2026-63190 FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS

FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn authentication checks, CSRF protection or adequate path validation. On PHP's built-in...

CVE-2026-63190 FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS

FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn authentication checks, CSRF protection or adequate path validation. On PHP's built-in...

EUVD-2026-112405

FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn authentication checks, CSRF protection or adequate path validation. On PHP's built-in...

CVE-2026-118266 Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POS...

CVE-2026-118266 Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POS...

EUVD-2026-112403

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POS...

CVE-2026-118687

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full...

CVE-2026-118263

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with...