NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides

Summary A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the @nocobase/plugin-action-custom-request plugin. A low-privileged authenticated user can call the customRequests:send endpoint and override the stored request URL at runtime using options.url. This causes the...

Malware in supership-scan

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835

Summary Rack::Requesthostwithport, and therefore baseurl and url, return the raw authority string when it fails validation. An attacker-controlled Host, X-Forwarded-Host, or Forwarded: host= value containing characters that are not permitted in an authority is embedded verbatim in URLs generated ...

Malware in @lemili9804/mcp-weather-server

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch

Summary Rack::Static normalizes the request path with Utils.cleanpathinfo when deciding which file to serve, but matches headerrules against a path that is only URL-decoded. A request containing dot segments, raw or percent-encoded, is served the normalized target file while the header rules for...

Malware in direct-message-receiver

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in discord-dm-parser

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in discordjs-dm-parse

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in discord-selfbot-functions

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in sms-activate.js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in discord-user-parser

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in discord-badge-parser

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output

Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in everything compose-lint prints, and the 0.31.0 changelog says the report "escapes both openers also covering Azure...

Malware in tchain-api

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Git security vulnerabilities announced

Today, the Git project is releasing new versions to address six security vulnerabilities. These include arbitrary code execution when recursively cloning a malicious repository, writes to unintended files, and memory corruption when processing merges or binary patches. The fixes are included in G...

Malware in agent-trace-kit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in neat-terminal-visualizer-84721

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in period-newline

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in agui-session-recorder

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in redeem-onchain-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in nicegui

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in mcp-contract-tester

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @solarcraft/observix

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @solana-common/utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @unipswap/postcss-animate-units

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwind-kinetix

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document

Summary An XSS Cross-Site Scripting vulnerability occurs when an attacker is able to inject their own JavaScript code into a web page's source, which is subsequently processed by the victim's browser. A common cause of this vulnerability is the failure to validate user-supplied data before...

Forge: Certificate signature verified with the issuer's RSA signature scheme

Summary When verifying a certificate, node-forge chose the RSA padding scheme PKCS1 v1.5 or RSASSA-PSS and PSS parameters from the issuer certificate's own signature algorithm instead of the certificate being verified. A certificate labeled as signed with RSASSA-PSS could pass...

Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

Summary decipher.finish in CBC and ECB mode accepted malformed PKCS7 padding: only the last byte was checked, against a limit of four blocks, so mismatched padding bytes, a zero count and oversized counts were accepted and up to four blocks of plaintext could be silently removed. Fixed in...

Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage

Summary forge.pki.verifyCertificateChain enforces the pathLenConstraint of a CA certificate's basicConstraints extension only when that certificate also has a keyUsage extension. For a CA certificate with a pathLenConstraint and no keyUsage, chains with more intermediate CA certificates below it...

Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer

Summary asn1.fromDer decodes the contents of BIT STRINGs as ASN.1 by default. That decode ignored the maxDepth recursion limit an incomplete fix of CVE-2025-66031 and also decoded nested BIT STRINGs, keeping a full copy of the decoded contents at each level, so small crafted DER or PEM inputs...

Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding

Summary RSASSA-PKCS1-v15 signature verification publicKey.verify with the default scheme, also used by X.509 certificate and PKCS7 verification accepted non-canonical BER encodings of the DigestInfo, such as NULL parameters with content and non-minimal lengths. These leave attacker-controlled byt...

Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()

Impact The name, domain, and path fields of makeCookie were validated with a regex that allows ;, the attribute separator in Set-Cookie headers. Because serializeCookie writes those fields verbatim, a caller who passes untrusted input into any of them can append arbitrary attributes to the header...

OctoPrint: Stored XSS via saved connection parameters

Impact OctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default port or baudrate setting on the bundled Serial Connector plugin, supplied via the API as new defaults during a connect request. Patches The vulnerability is patched...

Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

Summary Altair 8.5.7 accepts plugin configuration directly from the iframe-sandbox query string. When pluginsandboxopts contains type: "scripts" and an attacker-controlled URL in scriptUrls, the sandbox page creates a classic element and loads the supplied script. In the intended plugin flow, thi...

bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

Summary fastMerkleRoot pads an odd level by hashing the last node with itself. It does not report that it did so, and checkTxRoots never looks for repeated transactions. A peer can therefore duplicate transactions to fill the pad and produce a block with a different transaction list but the same...

compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

Impact This is an incomplete fix for GHSA-jf3h-8jvx-vcrg. 0.32.0 made findings quote the $NAME a sibling .env filled in, instead of its value. The same release added a stop at 20,000 findings per document, and that stop is checked before the quoting step. A run that hits it reports the findings...

GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover

Impact An authenticated non-administrative user could access a Kubernetes cluster they are not authorized to access through GPUStack's Kubernetes API proxy. The clusterapiserverproxy handler did not perform a resource-level authorization check before forwarding requests to the selected cluster...

AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

Summary SandboxShellTool's restricted modes — allowed=... explicit command allowlist and readonly=True implicit READONLYCOMMANDS allowlist — can both be bypassed by embedding a newline character inside the command string. The filter only inspects a single-line set of shell metacharacters, but...

GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

Impact The callback Base64-decodes the posted XML, reads NameID and attributes, resolves or provisions the user, and mints a gpustacksession JWT — but never calls OneLoginSaml2Auth.processresponse, the step that verifies the signature, issuer, audience, destination, and time conditions. No...

Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API

Summary The POST /nuxtcontent/:collection/query endpoint in @nuxt/content accepts an attacker-controlled sql field from the HTTP request body and executes it against a local SQLite database after passing it through an insufficient validator assertSafeQuery. The validator only blocks a small set o...

compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output

Impact Like Docker Compose, compose-lint follows symlinks when it reads a project's files. Unlike Compose, compose-lint up to 0.24.0 could then put the contents of a file from outside the project into its output, where the author of a pull request can read it. A pull request can commit a symlink,...

compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target

Impact compose-lint automatically reads a .compose-lint.yml policy file beside the Compose file. It is meant to read nothing outside the project directory, but it follows that file if it is a symlink, wherever it points. A pull request can commit .compose-lint.yml as a symlink to a file on the CI...

compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings

Impact Since 0.22.0, compose-lint fills in $VAR references from the .env beside the Compose file, as Compose does. The documentation says values under environment: are never resolved from a .env, "that is where secrets live". But image: values are resolved, and CL-0004 and CL-0019 quote the...

compose-lint: `fix --apply` can delete a line the user did not select, including a security setting

Impact compose-lint fix --apply converts the line numbers its fixers work with into positions in the file. The YAML parser treats a lone carriage return, U+0085, U+2028 and U+2029 as line breaks, but the conversion counted only \n. One of those characters inside a quoted value, which most editors...

compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action

Impact The GitHub Actions runner treats certain text in a step's output as commands. The legacy form, command, is recognized anywhere in a line. compose-lint's text report prints service names, environment keys and lines of the Compose file, and it does not neutralize . Inside the compose-lint...

compose-lint: .env read through a symlink outside the project can expose the CI job's environment

Impact compose-lint fills in $VAR references from the .env file next to the Compose file. It is meant to read nothing outside the project directory, and envfile:, include: and extends: paths are checked for that. The .env read is not. If .env is a symlink, compose-lint follows it wherever it...

Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks

Summary An attacker who can modify the attested workload’s code, memory-backed state, or configuration after the initial attestation — but without necessarily terminating the existing TLS connection — can cause the peer to continue trusting the connection as if the originally attested state were...

node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

Summary An unauthenticated Anonymous client can Write protected Variables and Call privileged Methods on any Node that lacks explicit per-node permissions. This follows the inheritance model defined by OPC UA Part 3, §5.2.9, where nodes without an explicit RolePermissions attribute inherit the...

Dagu MCP DAG specification read bypasses path containment and workspace isolation

Summary The traversal fix for CVE-2026-33344 was implemented as HTTP middleware installed only in the chi handler chain, but the MCP service calls the same API method in process, so arbitrary YAML file read is reachable again through the MCP tool surface with a viewer-role key. Read-only, limited...