GHSA-47W9-6R3F-938G LXD has restricted project bypass leading to arbitrary command execution

Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qemu. Details...

GHSA-7MR3-28H5-M5VX LXD has project restriction bypass for custom volume copy across projects

Reported from https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f Summary Missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custo...

GHSA-QX75-2P3R-PWM5 LXD has project restriction bypass in instance copy across projects

Reported from https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg Summary Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a...

GHSA-R4HM-P9F9-FJ9V GeoNode has Stored XSS in Documents metadata abstract field

The abstract metadata of documents is not sanitised. It’s possible to store arbitrary HTML and JS that will be executed when visiting the page...

GHSA-FQPV-MQ26-PR4J GeoNode has Unrestricted File Upload

The upload service validation can be circumvented with specially crafted requests, allowing for the storage and serving of malicious files...

GHSA-9FPX-FR6J-2VH6 GeoNode has OS command injection via uploaded file layer name

Arbitrary OS commands can be executed on the GeoNode by uploading a vector file with a crafted layer name...

GHSA-J93M-3J9P-M5M8 LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at

Summary sibling-field variant of CVE-2026-40197 fix 05bc272 lxdBackend.CreateCustomVolumeFromBackup in lxd/storage/backendlxd.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with...

GHSA-PJFF-C2WC-F6JM LXD has arbitrary file write on client due to trusted image hash

Reported from https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x Summary An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Details -...

GHSA-FMC8-P6Q7-75CC LXD has argument injection in backup compression algorithm leading to AFW and ACE

Reported from https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 Summary Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrar...

GHSA-VGHH-5RFX-XHQ8 LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details Incus validates an image as soon as it sees a normal...

GHSA-JPF8-86F3-WP38 LXD has arbitrary file read+write on host via templates/ symlink in malicious image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details For container images, internal/server/storage/utils.go cal...

GHSA-9J25-MM2H-2F76 LXD has arbitrary file write on host via `exec-output` symlink in crafted image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary The record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and...

GHSA-3GQ2-X4QG-P4G6 LXD: SSRF via image import from URL allows internal network probing by authenticated users

Summary The LXD image import-from-URL endpoint POST /1.0/images with source.type=url makes server-side HTTP requests to an attacker-supplied URL without any private-IP or loopback blocking. An authenticated user with the cancreateimages entitlement can force the LXD daemon to connect to internal...

GHSA-XGJR-7J9Q-2H4R listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

Summary A SQL injection vulnerability in GET /api/subscribers/export allows an authenticated user with the subscribers:sqlquery permission to bypass the table access control that exists on the regular query endpoint GET /api/subscribers and read arbitrary tables from the database — including user...

GHSA-5W5G-J6HW-6P8F OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy

Impact The console-proxy's RemoteConfigResolver parses kubeconfig data from Kubernetes Secrets using clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. A kubeconfig containing an exec plugin stanza under users.user.exec is faithfully preserved. When rest.TransportFor...

GHSA-92R3-P8C2-3FPX Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration

Description A privilege escalation vulnerability has been identified in the Direct Device Integration DDI Controller of Eclipse hawkBit versions 1.0.3 and prior. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates...

GHSA-M5PH-MMG5-6W5H filecoin-pin: Unbounded DAG pinning can exhaust server resources

Summary The IPFS Pinning Service API implementation accepts a caller-controlled CID through POST /pins, queues background processing, and then recursively fetches the full DAG with helia.pins.addcid. The route and background pinning path do not enforce a request rate limit, per-user quota, maximu...

GHSA-64VX-6H2C-RJH7 Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

Summary banks parses Tool JSON objects from the rendered body of % completion % blocks and later resolves their importpath field through importlib.importmodule... + getattr... to obtain the callable that handles a tool call. There is no allowlist or sanitization on importpath, so any importable...

GHSA-5Q7H-W9JF-CX97 kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

Summary kaniko before v1.25.20 can send a Microsoft Entra ID Azure AD access token for Azure Resource Manager to a registry host an attacker controls. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img, is enough. The build needs no RUN instructi...

GHSA-HHF9-QW4V-72XP lxd allows Cross-guest volume hijack via DevLXD device patch

Summary A guest can mount another guest's custom storage volume over /dev/lxd and read or write its contents without owning it. The DevLXD storage API blocks access to volumes you don't own, but the instance device-update path that attaches a volume to a container without checks ownership. Any...

GHSA-93CM-2V4M-C56C Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Summary The fix for CVE-2026-47735 released 2026.06.1 is incomplete. It added a DuckDB sandbox SET GLOBAL alloweddirectories=; SET GLOBAL enableexternalaccess=false and an Arc SQL-layer denylist of the literal functions readparquet and arcpartitionagg. The sandbox correctly blocks reads outside t...

GHSA-MC8M-RR6C-R5QR @payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter

Impact In affected configurations, client upload access does not consistently align with the associated collection’s access configuration. You are affected if: - You use client uploads with @payloadcms/storage-vercel-blob. - Authenticated users can access the client-upload route. Applications tha...

GHSA-3CGG-C5PP-57H6 odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values

Summary ODF style attribute values are interpolated into style="..." attributes without HTML-escaping in both of odf-kit's to-HTML renderers odtToHtml and odsToHtml. A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute...

GHSA-GH9R-C94J-CMP5 Stanza: RCE via pickle deserialization in the lemmatizer

TL;DR Loading an attacker-supplied lemma .pt runs arbitrary code as the loading user. Since 1.14.0 the lemmatizer stores posdict as a gzip-compressed pickle in the checkpoint's dicts field a bytes value. torch.loadweightsonly=True treats bytes as a primitive and passes it through unexamined, so i...

GHSA-P3JP-9V83-76W9 Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability

Executive summary A buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege. ASP.NET...

GHSA-48V2-6JCM-FC99 praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)

Impact A remote Telegram user can write files to arbitrary paths inside an agent's persistent workspace volume praktor-wk-, mounted at /workspace/agent, escaping the documented uploads/ directory. The attacker controls the Telegram document filename, which was concatenated into the destination pa...

GHSA-J97H-3F8R-MRJR Keycloak has authentication bypass via jwt algorithm confusion

Description A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the...

GHSA-9PPR-WFW9-XVR2 Netfoil doesn't decrement TTL

Summary TTL was not decremented, so stale records would continue to be served...

GHSA-H26J-4VP7-X9W2 Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution

Summary Metalama uses a local named-pipe channel to communicate between its Visual Studio processes — the Visual Studio UI process devenv, the out-of-process Roslyn code-analysis process, and the CodeLens process. This channel deserialized messages from the pipe without restricting which CLR type...

GHSA-M3QR-FVP4-78XJ Arc has unauthenticated application log disclosure via `/api/v1/logs`

Summary Arc exposes GET /api/v1/logs without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check. Details A...

GHSA-J656-3HF2-FVJC DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

The read-only mode can be bypassed on the MySQL and MariaDB connectors. In read-only mode a caller can still execute arbitrary write and DDL statements for example DROP TABLE, which defeats the protection that read-only mode is meant to provide when a database is exposed to an AI agent. Root caus...

GHSA-F9J6-8P6X-R9J6 SD JWT JS: Tampered disclosures silently dropped instead of rejected

Summary When one Disclosure in an SD-JWT presentation is tampered so its digest no longer matches the Issuer-signed sd array, @sd-jwt/decode 0.19.0 does not reject the presentation. It silently drops the unmatched Disclosure and returns a reduced claim set, reporting success. The Issuer signature...

GHSA-8FMV-6RG5-5924 Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Summary The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file,...

GHSA-WG5Q-X4J9-QM54 Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

Summary The Kubeflow Pipelines API server's GET /apis/v1alpha1/runs/runid/nodes/nodeid/log handler retrieves logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and a suitable pod or node identifier can read live or archived...

GHSA-5849-834G-HVW5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires opening an incomplete file without a trailer. Patches This has been fixed in pypdf==6.21.4. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4289...

GHSA-CGGF-277G-3Q54 pypdf has possible large memory usage when parsing page tree

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the page tree with many shared resources. Patches This has been fixed in pypdf==6.21.4. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4290...

GHSA-MFR5-77XH-9J7H pypdf has possible infinite loop when cloning dictionaries

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires cloning/duplicating a DictionaryObject. Patches This has been fixed in pypdf==6.21.4. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4288...

GHSA-4528-X5FX-H6HG joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

Summary Joi.string.email multiple: true takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service. Details When the multiple option is set, the email rule spli...

GHSA-8494-F6MR-CJPV @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

Summary Content.disposition takes quadratic time when a Content-Disposition parameter contains a long token without =. One unauthenticated multipart request can block the Node.js event loop for several minutes. Details Content.disposition reads the parameters with a global regular expression in...

GHSA-G3HV-75WG-M249 minimatch has potential denial of service via globparts amplification

minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess when optimizationLevel = 2. researcher: Reid Downing b1nv0id files: - src/index.ts: 690-770 - src/index.ts: 780-796 issue: input-controlled growth of globParts during first-phase preprocessing, followed...

GHSA-3G3M-2FJR-6PW4 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

Summary In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directories in the background. The root cause is that abort branches in src/walker.ts call cb without returning. As a result, callers that rely on signal or AbortSignal.timeout to bound glob...

GHSA-C73Q-W75P-J82V Authlib RFC 7592 examples omit registration-access-token client binding

Description Summary RFC 7592 OAuth 2.0 Dynamic Client Registration Management Protocol lets a previously registered client read, update, or delete its own registration, authenticated by a registrationaccesstoken issued specifically to that client at registration time. The entire security model of...

GHSA-42GH-23HR-VPHW pypdf has possible long runtimes when retrieving page labels

Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4251...

GHSA-4VQV-7265-GM2W pypdf has possible large memory usage for exceptions in strict mode

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading an invalid dictionary. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4265...

GHSA-62M5-6WH8-28X7 pypdf has possible long runtimes/large memory usage for encrypted PDF files

Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This requires accessing the page count of an encrypted PDF file, which itself declares a wrong /Count value. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade...

GHSA-X3RH-GJGM-FMQC pypdf has possible large memory usage when parsing cross-reference streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires opening a file with cross-reference streams. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4269...

GHSA-2QM8-X737-GMW5 pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding

Summary In pyasn1 through 0.6.4, decoding a constructed BIT STRING with many fragments repeatedly shifts and copies the entire value accumulated so far. For fixed-size fragments, CPU time grows quadratically with the encoded input size. An application that passes sufficiently large,...

GHSA-MM57-4V3P-RCHX pyasn1 has quadratic-complexity denial of service in binary REAL decoding

Summary In pyasn1 0.6.4 and earlier, decoding a binary-encoded ASN.1 REAL with a large mantissa can consume CPU time quadratic in the mantissa length. The BER, CER, and DER decoders all use the affected RealPayloadDecoder. An application is exposed when it passes attacker-controlled ASN.1...

GHSA-9M75-VC3G-4X39 pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding

Summary In pyasn1 0.6.4 and earlier, decoding a constructed OCTET STRING or character string made of many fragments can spend disproportionate CPU time repeatedly copying the accumulated value. A separate indefinite-length ANY path has the same problem while collecting the encoded components. The...

GHSA-FM9C-5RCF-2Q5P pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding

Summary When an application decodes attacker-controlled BER, CER, or DER data without an ASN.1 schema, a container with many distinct long tag IDs can cause quadratic CPU use. Repeated inputs can exhaust CPU and reduce service availability. Details...