Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Summary When middleware.Static is mounted globally e.Usemiddleware.Static... and an application relies on a route- or group-level middleware guard to restrict a path that also falls under the served static root, a %2F-encoded request bypasses that guard while the file is still served. This is the...

Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Summary The Context.JSONP, Context.JSONPBlob, and internal jsonPBlob helper in context.go directly concatenate the caller-supplied callback parameter into a JavaScript response without any validation, escaping, or allow-listing. This creates a high-impact reflected XSS that can be triggered by an...

Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

Summary When echo.New is used without explicitly setting EchoIPExtractor, the RealIP method falls back to reading the client-supplied X-Forwarded-For or X-Real-IP header without any proxy-origin validation. The default RateLimiter middleware derives its per-client identifier from ctx.RealIP, so a...

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Summary The MethodOverride middleware accepts any non-empty string as the override target method — including safe methods GET, HEAD, OPTIONS, TRACE — when rewriting a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain e.Use, it rewrites the request...

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Summary The Echo proxy middleware middleware/proxy.go preserves an incoming X-Real-IP header verbatim and forwards it to the upstream service when EchoIPExtractor is not configured — which is the default. Because any HTTP client can supply an arbitrary X-Real-IP value, an attacker can cause Echo ...

mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6

URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 Summary mcp-sanitizer v1.3.3 fails to block Server-Side Request Forgery SSRF targets when a localhost URL includes an explicit port e.g., http://localhost:8080/ or when an IPv6 loopback/link-local address...

mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

File Path Sanitizer Permits Arbitrary User-Home Absolute Paths Summary mcp-sanitizer v1.3.3 explicitly whitelists /home/ and /Users/ as allowed absolute path prefixes in its file path validation logic src/utils/validation-utils.js:188-196. As a result, paths such as /home/alice/.ssh/idrsa and...

rucio has an Authorization Bypass on REST API endpoint for signing URLs

Summary The /credentials/signurl endpoint decides authorization from the client-supplied X-Rucio-Account HTTP header instead of the authenticated token's account. Any client holding any valid auth token even a low-privilege account they legitimately own can send X-Rucio-Account: root to pass the...

MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)

Summary With SslMode set to VerifyCA or VerifyFull with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g.,...

Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

AI Disclosure This vulnerability was discovered via deepseek-v4-pro1m for finding potential vulnerabilities / inconsistencies in the code base. I made the AI check if Caddy is compliant with various RFCs, incl. 7230. I also used it to help write the PoC, since it was honestly much faster than...

Malicious code in black-spindle (npm)

Source: ossf-package-analysis c5ef30c4ec24f78fa57d10f6bd8e7fb7be307fc23e833428af785b2013bf2fab The OpenSSF Package Analysis project identified 'black-spindle' @ 999.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activit...

Malware in itsa-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in itsa-react-checkbox

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @walknpm/todo-cli

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in dsh-plugin-blender-3d

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in mock-transactions-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in transaction-info-generate-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in my-empty-package

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in camelotlabs-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in camelotlabs-config

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in camelotlabs-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in camelotlabs-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in camelotlabs-worker

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @atlisp/mcp

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @testsecuiitytestme/cache-helper (npm)

@testsecuiitytestme/cache-helper is the only package of the npm account testsecuiitytestme. It was created on 2026-10-27 at 12:08 UTC with npm's staged-publish placeholder 0.0.0-stage, followed by 1.0.1 12:28 UTC, 1.0.2 15:33 UTC and 1.0.3 16:24 UTC; a 1.0.0 was removed before 14:21 UTC. It...

Malicious code in csvflow-schema (npm)

csvflow-schema is described as a "Lightweight CSV column-schema validation helper" index.js exports a small validateSchema function and adds a postinstall script that runs node ./postinstall.js on npm install. postinstall.js writes the username, hostname, working directory, parent process id and...

Malicious code in @webapp-shared/login-vmok (npm)

@webapp-shared/login-vmok is a dependency-confusion package: it uses the @webapp-shared scope, which matches a private internal package scope, and was published on 2026-10-27 in versions 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0 and 99.0.1 so that builds resolving the internal name from the public regist...

Malicious code in trajmetrics (PyPI)

Source: kam193 3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271 When starting as a module, the package scans the whole system and exfiltrates selected files by type. If following the README instruction, it starts a background job constantly monitoring the system and exfiltrating...

Malware in glyphmatrix-fixture

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in csec-form-validator

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ccsec-form-validator

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in csec-form-validatorr

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ccsec-crypto-toolkit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ccsseecc-crypto-toolkit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ccsseecc-form-validator

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in csec-crypto-toolkit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in agentenact

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in...

MLflow CrewAI autologging records LLM provider API keys in logged trace spans

Summary mlflow.crewai.autolog leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI Agent is instrumented with MLflow autologging, MLflow serializes the agent's dict and converts its fields to strings. The llm field contains the CrewAI LLM object, whose string representati...

MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules

Summary MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlle...

dd-trace: ReDOS in URL query string obfuscation

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled. Patches This vulnerability has been...

Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server its audience. Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I...

OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

Summary JaegerPropagator.extract in opentelemetry-propagator-jaeger did not enforce limits when extracting inbound uberctx- baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept...

Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

Summary In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin: - custom headers set on the client for example an X-API-Key credential were sent to that origin, an...

Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

Summary In affected versions, when a connected MCP server declared an outputSchema for a tool, the SDK's client validated each calltool result with jsonschema's default resolver, which fetches any $ref it cannot resolve locally by opening the URL. A server could therefore put an http://, https://...

CKEditor: Cross-site scripting (XSS) in the engine package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code...

CKEditor: Cross-site scripting (XSS) in the engine package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the...

Neko: Authorization bypass in legacy WebRTC input handling

Impact When legacy mode is enabled and session.implicithosting is enabled, the legacy WebRTC data channel incorrectly authorizes input events due to a logic error in LegacyIsHost. As a result, an authenticated room member may be able to send mouse and keyboard input through the legacy WebRTC...

Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...