4335779 matches found
GHSA-5FQM-CC34-FCF5 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens
Summary GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This...
EUVD-2026-50027
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...
CVE-2026-59943
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...
CVE-2026-59943
Dompdf vulnerability (CVE-2026-59943) affects version 3.15 and earlier. In a data-URI encoded SVG, using an element with href/xlink:href pointing to local files (e.g., file:///...), the rendering process can leak filesystem information by differentiating behavior when a referenced file/directory...
CVE-2026-59943 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...
EUVD-2026-36072
Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape...
GHSA-R5JH-Q2MW-GCX4 Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
SanitizeFilePath in pkg/utils/utils.go validated that a path stayed under a safe directory by calling strings.HasPrefixpath, safedir. This is a lexical check, not a directory boundary check: /packages-extra/evil starts with /packages, so it passed. The function did not enforce a path-separator...
Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
SanitizeFilePath in pkg/utils/utils.go validated that a path stayed under a safe directory by calling strings.HasPrefixpath, safedir. This is a lexical check, not a directory boundary check: /packages-extra/evil starts with /packages, so it passed. The function did not enforce a path-separator...
CVE-2026-56722
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...
CVE-2026-56722
Dompdf (PHP HTML-to-PDF library) prior to v3.16 is vulnerable to local-file read via SVG in a data: URI. The attack wraps a local file path in an SVG image; dompdf processes the SVG twice, and the second pass hands the image to php-svg-lib with external references enabled. php-svg-lib then reads ...
EUVD-2026-50026
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...
CVE-2026-56722 Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...
CVE-2026-55555
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP...
CVE-2026-55554
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...
CVE-2026-48060
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
EUVD-2026-36071
Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory...
Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory
Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/evil therefore landed at /tmp/evil. An attacker who could control...
GHSA-Q6VM-XQC9-V3FF Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory
Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/evil therefore landed at /tmp/evil. An attacker who could control...
GHSA-VCHH-R53J-8MPW Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks
HTTPTriggerSpec.Validate validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only pkg/fission-cli/cmd/httptrigger/create.go:83. The post-CRD-modernization webhook for HTTPTrigger w...