js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

Impact This is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default When merge keys 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from 'node:buffer' import load, YAML11SCHEMA from 'js-yaml' const n = Numberprocess.argv2 || 4000...

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Impact js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one: yaml a0: &a0 k0: 0 a1: &a1 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from...

js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

Summary js-yaml v5.x introduces YAML11SCHEMA support with the !!omap ordered map tag. The omapTag.addItem function performs a linear On scan for duplicate key detection on every insertion, resulting in On^2 total time to parse a document with n omap entries. An attacker can send a small crafted...

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

Summary A scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope other tenants' data, and the application's own database via the upload failure-cleanup path. This is an incomplete fix of CVE-2026-54094: the v2.63.14 ScopedFs containme...

Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses

Summary Cloudreve's remote download workflow accepts user-supplied URLs and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets. When the remote download permission is granted to a non-admin user group, a normal...

Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Summary Cloudreve's OAuth access tokens can bypass OAuth scope enforcement. This does not appear to be the intended design. The documentation describes OAuth client permissions/scopes, the API has an insufficient-scope error code, and the code comments say RequiredScopes... should verify scopes...

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Summary WindowsViewer.getcommand constructs a cmd.exe shell command by directly embedding a file path into an f-string without escaping. The result is passed to subprocess.Popen..., shell=True. Shell metacharacters in the file path — most importantly a double-quote " that breaks out of the...

Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

Description PIL/GdImageFile.py GdImageFile.open reads image dimensions from the GD 2.x header and stores them in self.size without calling Image.decompressionbombcheck. Because GdImageFile is not registered with Image.registeropen, it never passes through the standard Image.open code path that...

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Summary PIL/BdfFontFile.py bdfchar lines 84–88 reads the BBX width height field from a BDF font file and passes the dimensions directly to Image.new without calling Image.decompressionbombcheck. This completely bypasses Pillow's documented decompression bomb protection. Image.open enforces...

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Description PIL/FontFile.py FontFile.compile assembles per-glyph images into a single combined bitmap using Image.new"1", xsize, ysize without calling Image.decompressionbombcheck. This is the base-class method shared by both BdfFontFile and PcfFontFile, and it is triggered whenever a loaded font...

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Description PIL/PcfFontFile.py loadbitmaps line 227 reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes without calling Image.decompressionbombcheck. Dimensions originate from unsigned 16-bit values: xsize = right - left max: 65535 − 0 = 65535 ysize =...

Astro: Reflected XSS via unescaped View Transition animation properties

Summary Astro's server-side View Transition CSS generator interpolates animation properties into an inline element without escaping them for the CSS and HTML contexts. An attacker-controlled value passed to an animation property such as duration can contain a sequence, terminate the generated sty...

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

Summary When Pillow loads an uncompressed image whose tile uses the raw codec and a mode in Image.MAPMODES, and the image was opened from a filename, it memory-maps the file and builds the image's row pointers directly into the mapping via PyImagingMapBuffer src/map.c. The per-row spacing stride ...

@better-auth/sso: SSO provider may allow registration for any org member without a checking their role

Am I affected? You are affected if all of the following are true: - You depend on @better-auth/sso at any version in = 1.2.10, 1.6.11, or any current next pre-release. - You enable both sso and organization plugins. - providersLimit is at its default 10 or any non-zero value, so SSO provider...

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

Summary brace-expansion's expand exhibits exponential-time - O2ⁿ - behavior in the number of consecutive non-expanding groups. A short, all-ASCII input 90 bytes/30 groups blocks the calling thread for minutes; a slightly longer input hangs it effectively indefinitely. Because the dominant consume...

Composer: Arbitrary file write outside vendor via malicious transitive package name

Summary A maliciously crafted package, published on an untrusted third party repository other than Packagist.org or Private Packagist, can cause Composer to write files outside the vendor/ directory and outside your project, with attacker-controlled content, during a normal install or update...

vLLM denial of service via prompt embeds on M-RoPE models

Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Sending a pure prompt embeds payload in a /v1/completions request with a model usi...

pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read

Summary An integer overflow in the encode path buffer validation of pillowheif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure server heap memory leaking into encoded images or denial...

changedetection.io is vulnerable to unauthenticated static path traversal

Summary The /static// route accepts group="..", which causes sendfromdirectory"static/..", filename to execute. This moves the base directory up to /app/changedetectionio, enabling unauthenticated local file read of application source files e.g., flaskapp.py. Severity is low information disclosur...

Tornado: Quadratic DoS via Crafted Multipart Parameters

Summary The parseparam function in Tornado's httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data. This function uses an inefficient algorithm that repeatedly calls string.count within a nested loop while processing quoted semicolons e.g., param=";". As a...

Tornado: Quadratic DoS via Repeated Header Coalescing

Summary The HTTPHeaders.add method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in On² time complexity. Given Tornado's single event loop architecture, a...

Tornado vulnerable to Header Injection and XSS via reason argument

Header injection and XSS via reason argument Summary The reason argument used by both RequestHandler.setstatus and tornado.web.HTTPError is designed to allow applications to pass custom "reason" phrases the "Not Found" in HTTP/1.1 404 Not Found to the HTTP status line mainly for non-standard stat...

Axios: Excessive recursion in formDataToJSON can cause denial of service

Summary Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON / named formToJSON API and the default request transform used when FormData is sent with an application/json content type. Applications are affected when they pa...

Axios: Prototype pollution auth subfields can inject Basic auth

Summary Axios versions after the GHSA-q8qp-cvcw-x6jj fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own auth object that omits username or password,...

Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Summary Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names to this...

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

Summary A wrong policy can be an open door. You have to check input.attributes.request.http.truncatedbody in your policy. Description Incomplete fix for CVE-2026-50197: an oversized declared-Content-Length body still hands OPA an empty parsedbody, so deny-on-presence Rego policies fail OPEN while...

Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication

Description The routesrv component exposes the full cluster route topology Ingress/RouteGroup configurations, backend URLs, filter chains, OAuth/OIDC callback paths and cache-cluster topology Redis/Valkey shard addresses over plain HTTP with zero authentication. Any pod in the Kubernetes cluster...

CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard

Authenticated full-read SSRF in CloudTAK /api/esri routes — user-controlled URL fetched with no IP-classification guard Summary Every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / layer...

PocketSphinx: Buffer overflows in language and acoustic model loading code

Impact The trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files. In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer...

AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

Summary The HTML specification requires that a MathML element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML. AngleSharp does not implement this correctly. As a result, the parser produces...

PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs

Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs Repository https://github.com/termux/proot-distro Maintainer: @sylirre Affected Component Package: proot-distro Affected command: copy Attack surface: Host-side Termux CLI — this is...

ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

Summary ExifReader 4.40.0 can throw an uncaught RangeError: Offset is outside the bounds of the DataView while parsing crafted HEIC/AVIF files. The file only needs a valid leading ftyp box with a HEIC/AVIF major brand followed by a malformed ISO-BMFF box, such as an empty 8-byte free box or a...

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Header | Field | Value | |---|---| | Title | Extension-denylist bypass via case-folding asymmetry in name-override path incomplete-fix variant of CVE-2026-27641 | | Project | Flask-Reuploaded flaskuploads | | Affected | extension"shell.php" = "php" - extensionallowed"php" - DENY correct...

Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

Summary The TypeScript Prompty loader used gray-matter without overriding executable frontmatter engines. gray-matter supports JavaScript frontmatter blocks such as ---js and evaluates them while parsing. An attacker-controlled .prompty file could therefore execute arbitrary JavaScript during...

Prompty: Arbitrary file read via file reference expansion

Summary Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to t...

mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath

Impact contextimport passed the caller-supplied filePath directly to fs.readFileSync with no path confinement. A malicious MCP client — or an LLM agent that is prompt-injected into calling the tool — could point filePath at any file readable by the server process, outside any session or export...

Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration

Formie contains a missing authorization vulnerability in administrative settings routes. An authenticated, non-admin Craft CMS control panel user with limited Formie access could directly access Formie settings pages and modify global plugin configuration. In affected versions, Formie...

Gitea has insufficient permission checks for Composer package source links

CVE Description Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information. Summary A critical vulnerability has been discovered in Gitea. It was already reported via...

TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard

Summary PUT /api/basemap the basemap import endpoint fetches an attacker-supplied URL server-side with no SSRF protection whatsoever. Any authenticated user can submit a JSON body "type": "...", "url": "" ; the server calls fetchurl against that URL and then reflects the response body name,...

oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code

Summary The vulnerability in oapi-codegen seems to be similar with CVE-2026-22785, which is a generated-code injection issue where untrusted OpenAPI summary text is embedded into generated TypeScript MCP server source without proper escaping. oapi-codegen has a similar vulnerability in its server...

meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token Summary AuthInjectionMiddleware in meta-ads-mcp rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent. Because extracttokenfromheaders does not recognise the X-Pipeboard-Token header, an attacker who sends...

meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

Server-Side Request Forgery SSRF in uploadadimage via Unrestricted imageurl Fetch Summary The uploadadimage MCP tool in meta-ads-mcp v1.0.113 passes an attacker-controlled imageurl parameter directly to an HTTP fetch helper httpx.AsyncClientfollowredirects=True.geturl without any scheme, host, or...

sh _uid does not drop supplementary groups (incomplete privilege drop)

Impact The uid option performed an incomplete privilege drop on Linux/Unix-like systems. When sh was run from a process with elevated privileges, such as root, and a command was launched with uid=, the child process changed its UID and primary GID but did not reset its supplementary groups. As a...

AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL. The team has identified CVE-2026-11400, an issue in Aurora PostgreSQL using the AWS Advanced JDBC Wrapper Impact An issue in AWS Wrappers for Amazon Aurora PostgreSQL will allow for privilege...

plone.restapi: Stored XSS by spoofing mime type

Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

plone.app.textfield: Stored XSS by spoofing mime type

Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

Summary The Kubernetes admission webhook handler reads the entire request body using io.ReadAllr.Body without any size limit. Any client that can reach the webhook port within the cluster can send a multi-GB payload, causing the skipper process to exhaust memory and be OOM-killed. This disrupts a...

vLLM: Speech-to-text upload size limit is enforced after full UploadFile read

Summary Current-head vLLM documents VLLMMAXAUDIOCLIPFILESIZEMB as the maximum audio file size accepted by the speech-to-text APIs. The default is 25 MB. vllm/envs.py also describes files larger than this value as rejected. The /v1/audio/transcriptions and /v1/audio/translations routes call await...

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

Summary The structuredoutputs.regex API parameter passes a user-supplied regex string directly to grammar compiler backends with no compilation timeout. In the xgrammar backend, the string reaches compileregex with no guard. In the outlines backend, validateregexisbuildable blocks structural issu...