@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

Summary When prettyUrls: true is enabled on @apostrophecms/file a documented SEO feature for serving uploaded files at clean URLs, the public pretty-URL handler builds the upstream URL using the raw Host HTTP request header: js proxyUrl = $req.protocol://$req.get'host'$uglyUrl That URL is then...

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

Summary apos.util.set traverses dot-notation paths without sanitizing proto, allowing an authenticated editor to write arbitrary values to Object.prototype via the $pullAll patch operator. A confirmed gadget in publicApiCheck causes this to bypass authorization on all piece-type REST API endpoint...

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

Summary sanitize-html uses allowedSchemesAppliedToAttributes default: 'href', 'src', 'cite' to gate the naughtyHref function that blocks dangerous URI schemes like javascript: and vbscript:. The HTML specification defines 10+ attributes that accept URIs action, formaction, data, poster, backgroun...

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

Summary The free5GC AUSF Authentication Server Function does not validate the supiOrSuci field in UE authentication requests. Null bytes \x00 and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse to...

zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit

Summary NonFinalizedState::handlereorg is a recursive, unbounded async function that traverses parent blocks until it finds a common ancestor on the main chain. It has no recursion depth limit and no cycle detection. A malicious or buggy validator can serve a block whose previousblockhash points...

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

Summary GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal template string with no escape, type cast, or parameter binding. The action ACL is loggedIn, so any...

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Summary rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example shell.php.any.jpg. The check only catches the blocked extension when it appears at the en...

ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash...

Savon::Model evaluates WSDL operation names as Ruby source

Impact Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to moduleeval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .alloperations class method...

Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

A element placed directly inside an or MathML container was not removed by Jodit's clean-html sanitizer. The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign SVG/MathML elements preserve their original-case node names — an SVG script reports "script", not...

Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

Summary jodit's built-in clean-html sanitizer can be bypassed by a MathML/ carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value. When an application supplies attacker-influenced HTML to the editor's value-set or...

Jodit has prototype pollution via Jodit.configure() / ConfigMerge

Summary Jodit.configureoptions — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototy...

Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Summary jodit's sanitizeHTMLElement neutralizes a javascript: href using a bare href.trim.indexOf'javascript' === 0 check. This omits the normalization jodit applies to every other URL attribute: isDangerousUrl strips control bytes with value.replace/\u0000-\u0020+/g, '' and lowercases the value...

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

The fileloader performs unquote on the file path AFTER the abspath + startswith security check. An attacker can use percent-encoded path traversal sequences %2e%2e for .. that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences. Affected code...

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

Summary Thumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. Details - Filter implementation: thumbor/filters/proportion.py - value is parsed ...

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Summary The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service ReDoS. Details The RegExp for convolution is defined as...

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Summary Thumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C code triggers undefined behavior; on x8664 this reliably results in a...

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

HMAC validation bypass via multiple .replace calls when removing URL signature Summary Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can...

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

Impact A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5. The library recursively merged user-supplied objects without filtering unsafe property names such as proto, constructor, and prototype. An attacker able to supply crafted input could cause properti...

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

Summary The vault-secrets-webhook reads the vault.security.banzaicloud.io/vault-addr annotation from any ConfigMap or Secret being admitted and uses it as the Vault server address without any validation or allowlist. When a ConfigMap or Secret contains a value prefixed with vault:, the webhook's...

hashi-vault-js has a path traversal and query parameter injection

Summary The hashi-vault-js library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject...

dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

Summary isurlsafe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery. POC Example to simulate 1.1.1.1 in version before 1.5.0 of dssrf: js import isurlsafe from...

Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

Summary CVE-2026-22872 GHSA-qjjm-7j9w-pw72 reported that a Tenant Owner could create cluster-scoped resources e.g. ClusterRole, ValidatingWebhookConfiguration through a TenantResource, because the controller applies them with its cluster-admin ServiceAccount and SetNamespace is ineffective for...

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Summary CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and ForbiddenAnnotations.Regex are never validated by any admission webhook. A Cluster Admin can persist a malformed regex to etcd without being blocked. Once stored, every Node CREATE, UPDATE, or PATCH request triggers...

re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

Summary re2 validates the user-settable lastIndex against the subject's UTF-8 byte length but then uses it as a UTF-16 code-unit count to walk the subject buffer, with no bounds check. For any non-ASCII subject, the byte length is larger than the true character count, so a lastIndex between those...

re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

Summary String.prototype.match with a global RE2 collects all matches in a native loop that advances the cursor by the match length. A zero-width empty match has length 0, so the cursor never advances: the same empty match is found forever and appended to an ever-growing native vector. Any patter...

Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII

Impact Two unauthenticated Mollie shop endpoints look up orders by a sequential integer orderId with no ownership or session check. Chained, they expose customer PII. GET /locale/thank-you PageRedirectController::thankYouAction, route syliusmollieshopthankyoupageredirect loads the order with...

Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook

Impact The shop payment webhook POST /locale/update-payment route syliusmollieshoppaymentwebhook accepts two independent, attacker-controlled parameters: id the Mollie payment ID, verified against Mollie's API and orderId the Sylius order ID, read directly from the database. The handler never...

Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

Summary A remote, unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener. When a DATA frame is processed for a stream whose decompressor has already been closed,...

Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

Summary nltk.pathsec provides an SSRF filter that NLTK documents as a security control, blocking loopback, private, link-local, and multicast ranges including obfuscated forms and recommending strict ENFORCE mode for security-sensitive environments. The filter is bypassable by DNS rebinding:...

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Summary ReviewsCorpusReader extracts feature annotations of the form label followed by a bracketed signed digit e.g. a label then +2 from each review line, using the module-level FEATURES regex. The feature-label sub-pattern is unbounded — an optional greedy run of word-plus-whitespace groups...

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

Summary A path-traversal vulnerability in NKJPCorpusReader allows an attacker who can influence the fileids argument of its public read methods header, raw, words, sents, taggedwords to read files outside the corpus root. The reader builds the file path with no containment check and opens it with...

Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

Summary FramenetCorpusReader.framename interpolates a caller-supplied frame name into an XML file path that is read with the builtin open, bypassing CorpusReader.open and the nltk.pathsec sandbox — including strict ENFORCE=True mode. A ../ sequence in the name escapes the corpus root, yielding an...

`nx graph` dev server permissive CORS policy

Summary The local HTTP server started by nx graph sent Access-Control-Allow-Origin: on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help...

Spring Data: Unbounded property-path cache keyed by externally-supplied path string

src/main/java/org/springframework/data/mapping/context/PersistentPropertyPathFactory.java:175 · Unbounded Resource Allocation Algorithmic DoS Impact When a consuming module routes user-supplied dot-paths sort parameters, projection paths, PATCH paths through...

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

Summary OnionShare CLI/Desktop 2.6.3 can follow symbolic links inside a selected Share or Website directory and serve the symlink target rather than limiting access to files physically contained in the selected directory. If a user shares a directory that contains attacker-supplied or otherwise...

OnionShare Receive mode writes uploaded files even when file uploads are disabled

Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint --disable-files / "Disable uploading files", a remote sender who can reach the OnionShare service can still sen...

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Summary A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic. Impact All wings users with an open SFTP port. Workarounds Close SFTP port...

Wings exposes node configuration secrets through egg configuration-file templating

Impact Type: Exposure of sensitive information / insufficiently protected credentials leading to privilege escalation and full node compromise. Wings exposes its entire daemon configuration to the egg configuration-file templating engine. When Wings renders a server's configuration files, any...

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Summary Config file parsers, json, yaml, xml etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process. Impact All wings users who have an egg with a non-file parser configuration file setting...

`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

Summary @dynatrace-oss/dynatrace-mcp-server v1.8.5 exposes an HTTP transport mode --http flag that performs no authentication, session validation, or origin/host verification before dispatching MCP tool calls. Any network-reachable attacker can send a raw JSON-RPC tools/call request without an...

@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification

Summary A template injection vulnerability in the createworkflowfornotification tool lets a caller embed Jinja2 expressions that the Dynatrace workflow engine evaluates at runtime, exfiltrating event data to attacker-controlled destinations through a workflow that persists in the tenant after the...

@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL

Summary A DQL injection vulnerability in several read tools lets a caller bypass the tools' documented field-scope, time-window, and display caps by injecting DQL pipeline stages through parameters typed as identifiers. Details Several tools interpolate caller-supplied parameters directly into DQ...

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

Summary The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities components, forms, views, and themes primarily used in AWS Amplify Studio for component previews and in AWS Command Line Interface AWS CLI for generating component files in...

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secretkeybase and often credentials for external systems, which...

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Summary MessagePack::Bufferclear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor rmemlast, rmemend, rmemowner. The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has...

dssrf has an SSRF bypass with remove_at_symbol_in_string

Summary isurlsafe in v1.0.3 contains an SSRF bypass. removeatsymbolinstring is applied to the raw URL string before new URL parses it. This strips the @ that separates userinfo from host, corrupting the hostname so internal IPs are never checked. Vulnerability In helpers.ts, isurlsafe does: ts u ...