Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver

Summary HasUploadFields used via CrudTrait on Backpack-managed models and the withFiles uploader preserve the client-supplied file extension without validation. On installations using a public disk with php artisan storage:link, this allows an authenticated administrator to upload a file with a...

Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check

Summary MyAccountController::postAccountInfoForm allows an authenticated user to update the authentication column default: email without verifying their current password. Because email is the account-recovery anchor, this enables account takeover after the attacker's session ends: the new email...

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Summary The MyAccountController::postAccountInfoForm action bound to POST /admin/edit-account-info calls $this-guard-user-update$request-except'token'. Because the controller uses except'token' rather than $request-validated or the restricted keys defined in AccountInfoRequest::validationData, an...

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

Summary The init guard middleware in Qinglong only checks /api/user/init paths but not /open/user/init, which is whitelisted from JWT authentication and rewritten to /api/user/init after the guard has already passed, allowing unauthenticated admin credential reset on initialized instances. Affect...

Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For...

OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers

Impact Unauthenticated denial of service. Summary When OpenTofu performs requests against an untrusted or compromised third-party server or connects to an attacker-controlled server, the initial connection negotiation can produce high CPU usage, leading to possible denial of service. These...

Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI

Summary Ember's interactive TUI renders fields taken from the monitored Caddy server's access logs — most notably the request URI — straight to the operator's terminal without neutralising terminal escape or control sequences CWE-150. Those log fields are populated from arbitrary, unauthenticated...

node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. Affected versions: = 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 High CVSS Vecto...

node-opcua missing nonce verification in UserNameIdentityToken authentication

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

next-video: Unauthenticated arbitrary file read via /api/video request handler

Impact The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the production filesystem of any application following the documented setup. The...

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Summary The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. Note: Exploitation requires the Owner role which already holds fu...

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

Zoo Design Studio: Memory-corruption in memory handling of lib-kcl

A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent getenv operation that has already loaded a pointer to the old buffer may subsequently index...

Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service

Impact Feeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive expression - unnecessarilybracketed - expression path. With enough nesting, the call stack grows until it exceeds the process stack limit, causing a stack overflow...

stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address

Summary Stigmem allows an authenticated user to create a webhook subscription with a user-controlled deliveryaddress. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request. The codebase already contains an outbound...

NocoBase backup restore schema name allows command injection

Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

Executive Summary A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list and MongoDBStore.search methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query...

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

Summary Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. As a result, an unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target group’s store. In addition, the receiv...

asteval has a Sandbox Escape via BaseException Subclasses

Summary An attacker who can supply expressions to asteval.Interpreter.eval can raise SystemExit, KeyboardInterrupt, GeneratorExit, or BaseException from inside the sandbox. These exceptions are subclasses of BaseException but not Exception, so they bypass the except Exception: safety net in both...

asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

Summary With its default configuration numpy enabled, import disabled, asteval's Interpreter lets an attacker-controlled expression obtain a raw arbitrary process-memory read and write primitive, without using import, any dunder attribute, or eval/exec/getattr. Arbitrary in-process read/write is...

vouch-proxy has an Unbounded Multipart Cookie Allocation DoS

Unbounded Multipart Cookie Allocation DoS in vouch-proxy Summary vouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The /validate endpoint parses the total cookie part count directly from the attacker-controlled cookie...

OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

Summary go.opentelemetry.io/otel/bridge/opentracing introduced an unsynchronized extraBaggageItems map on bridgeSpan. One goroutine can write this map through Span.SetBaggageItem while another goroutine reads and iterates it during correlation baggage propagation, which can trigger Go's fatal...

Velero vulnerable to file path traversal when extracting from backup's tarball

Impact What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: ../../../tmp/escape1 - file created at /tmp/escape1 ../../../../../../../../tmp/escape2 - file...

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...

Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...

logto-tunnel serves files outside --experience-path via path traversal

Summary @logto/tunnel serves custom sign-in experience files from the --experience-path directory. When the tunnel service is reachable, a requester can use ../ path segments in a static asset request to read files outside that directory that the CLI process can read. Details The tunnel command...

BuildKit has a possible runtime DoS via unbounded group parsing

Impact Maliciously crafted base image or build can cause a Denial of Service DoS condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory OOM kill of the buildkitd process. Patches Issue is fixed in BuildKit v0.31.1+ Workarounds Use trusted build...

BuildKit: Custom frontend could bypass Seccomp/AppArmor

Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers...

SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

Summary mcp-searxng version 1.11.0 exposes SearXNG Basic Authentication credentials embedded in the SEARXNGURL environment variable. When the server starts in STDIO mode and an MCP client connects, the complete SEARXNGURL, including its username and password, is sent to the client through an MCP...

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Summary The default .htaccess shipped with Grav and the reference webserver-configs/htaccess.txt contains security rules that block direct HTTP access to sensitive file types .yaml, .yml, .php, .json, .twig, etc. under user/ and system/vendor/ directories. However, these rules lack the NC No Case...

Snipe-IT: Stored DOM XSS via table selected-count IDs

Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and supplier detail pages, stored manufacturer or supplier names are passed into affected table components as that name value. The client-side JavaScript later reads the browser-decoded...

Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

Impact Any activated account in a company can read every maintenance record for that company asset tag, supplier, purchase cost, free-text notes, dates without holding any asset or maintenance permission. Summary MaintenancesController::show renders a maintenance record without any authorization...

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

Impact An attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application. Steps to Reproduce: 1. Log in as a restricted user. 2. Send a GET request to /api/v1/users/targetid/eula...

Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode

Impact Due to inconsistent authorization checks, a company-scoped user can bypass tenant boundaries to read, mutate, and soft-delete users who do not belong to any company companyid = null. While direct instance authorization isCurrentUserHasAccess correctly denies access to these out-of-scope...

GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

Summary A server-side template injection SSTI vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a...

SearXNG MCP Server: Additional hardened-mode SSRF bypasses

Summary mcp-searxng has a hardened-mode URL-reading feature intended to prevent weburlread from reaching private or internal network resources. PR 79 appears to address one SSRF class: hostnames that resolve to private or internal addresses under hardened mode. I tested PR 79 locally and confirme...

SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

Ref: https://github.com/ihor-sokoliuk/mcp-searxng/issues/87issuecomment-4645453694 Summary The weburlread tool fetches a caller-supplied URL server-side and converts it to markdown. An SSRF guard assertUrlAllowed, which blocks private/loopback/metadata addresses exists but runs only when...

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain data and metadata for datasets they are not authorized to access. Impact - Private record metadata disclosure. Record contact, keyword, and distribution sub-resource endpoints...

XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

Impact Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that page. This allows the user to obtain script right on the page. Script right allows the user to execute potentially dangerous Velocity scripts and send unfiltered HTML and JavaScrip...

MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...

Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

Impact A remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerabilit...

Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Summary exportspace and importspace tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters that are spread directly into the options object passed to contentful-export / contentful-import. These libraries pass the merged options — including the attacker-controlled host — t...

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier: trust-prefix bypass via path traversal runs tasks unprompted Summary In copier = 9.5.0, = 9.15.1, the trust setting's prefix match copier/settings.py compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when th...

Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS

Summary An unprivileged container can block all other containers from starting on the same host by placing a crafted /etc/ld.so.cache file in its filesystem. When Inspektor Gadget attaches any uprobe-based gadget, it parses this file in the container startup path. A malicious cache causes 53...

block_buffer: panic corrupts inline buffer position

Summary A caught panic may leave the cursor position of EagerBuffer or ReadBuffer in a corrupted state; this in turn allows out-of-bounds reads/writes. Details & PoC The following two tests fail miri: rust cfgmiri test fn eagerdigestblockspaniccorruptsinlineposition // EagerBuffer stores its curs...

claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Summary claude-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Summary faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to...

grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

Summary Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

Summary In affected versions of langgraph-api the LangGraph Server runtime, the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the...