Semantic MediaWiki'a Missing Authorization In The Smwtask API Module Allows Unauthenticated Access To Admin-only Mainten

Summary The "api.php?action=smwtask" API module performs no authorization check. The equivalent maintenance interface in the web UI "Special:SMWAdmin" requires the "smw-admin" right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can...

Missing Origin Validation

obsidian-tc is vulnerable to missing Origin and DNS-rebinding validation. The vulnerability is due to missing Host, Origin, and DNS-rebinding validation in the Streamable HTTP transport when authentication is disabled, which allows an attacker to exploit a malicious webpage to gain unrestricted...

Semantic MediaWiki's Special:FacetedSearch Cstate Hidden Inputs Enable Reflected XSS (residual Of CVE-2025-10354)

Summary Special:FacetedSearch "cstate" hidden inputs enable reflected XSS residual of CVE-2025-10354 Details Affected versions and vulnerable location - Confirmed present on latest shipped release tag available in the local clone: "SemanticMediaWiki/[email protected]". - Confirmed present...

Authentication Bypass

Better Auth is vulnerable to authentication bypass. The vulnerability is due to overlapping stored identifiers under specific Magic Link and OAuth configuration settings, which allows an unauthenticated attacker to exploit the OAuth sign-in flow to obtain a valid session for an existing user or...

VLLM: Responses API Bypasses Trust_request_chat_template For Chat_template_kwargs

Summary vLLM's "/v1/responses" endpoint accepts request-level "chattemplatekwargs", but does not apply the "--trust-request-chat-template" gate that protects Chat Completions, render, tokenize, and pooling paths. When the server is run with the documented default "trustrequestchattemplate=False"...

Authlib: Unvalidated Request_uri Fetch In JWT-secured Authorization Request (JAR) Leading To SSRF

Summary Authlib's RFC 9101 JAR extension passes the attacker-controlled "requesturi" authorization parameter straight to the "getrequestobject" fetch hook with no validation, at a pre-authentication endpoint. Authlib already defines the pre-registration allowlist for this "requesturis" client...

Fpdf2: Exponential SVG '<use>' Expansion Causes CPU And Memory Exhaustion In 'FPDF.image()'

Summary fpdf2 expands SVG "" references by deep-copying the complete referenced graphics tree. A small SVG can use nested references to make the number of in-memory objects grow exponentially, causing excessive CPU and memory consumption during "FPDF.image" processing. This was reproduced with an...

Filelock: SoftReadWriteLock Follows A Lock Tree Swapped In After Its First Acquire And Writes Lock Records Into Director

"SoftReadWriteLock" and "AsyncSoftReadWriteLock", which wraps one checks once per lock object, by name, that ".rw", ".rw/gen" and ".rw/holders" are real directories and not symbolic links files that redirect to another path. It then keeps only a boolean. Every later record operation resolves the...

GitPython Command Wrappers Omit Unsafe Protocol And Option Checks

Summary GitPython has spent 2022-2026 rolling out two reusable guards method-by-method: "Git.checkunsafeprotocolsurl" raises "UnsafeProtocolError" for "::" remote-helper URLs - CVE-2022-24439 and "Git.checkunsafeoptions..." raises "UnsafeOptionError" for denylisted option spellings -...

Model Context Protocol Python SDK: Server Bearer-token Authentication Accepts Tokens Issued For A Different Resource Ser

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server its audience. Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I...

VLLM: Permissive Default CORS Origins Allow Cross-origin Requests To The VLLM HTTP Server

Summary The OpenAI-compatible server registers Starlette "CORSMiddleware" with "allowedorigins" defaulting to """", and performs no authentication unless "--api-key" or "VLLMAPIKEY" is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach for...

Flexible GraphRAG: Cypher/Graph Injection Via Broken String-escaping In FalkorDB Adapter (_escape()) - Full Graph Wipe F

Description def escapev: str - str: return strv.replace"'", "'".replace"", "\" The escaping order is backwards, exactly like the classic HTML double-escape bug: step 1 inserts a literal backslash in front of every ', then step 2 re-matches that just-inserted backslash and doubles it. For an...

Filelock: SoftFileLock Removes A Live Holder's Marker When Another User Forges The PID In A Writable Marker

"SoftFileLock", "MarkerSoftFileLock", "SoftFileLease", their async variants and a "FileLock" that has fallen back to a soft lock on "ENOSYS" decide from the record inside the marker file whether its owner is gone. The marker is the file whose presence says a process holds the lock. They do not...

Tornado: Event Loop Blocking And Excess Memory Use From Chunked Bodies With Many Small Chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

VLLM: Out-of-vocabulary Prompt Token Id Passes Input Validation And Triggers A CUDA Device-side Assert (engine Crash / D

For a model whose vocabulary size is an exact multiple of the embedding padding size 64 — e.g. any Llama-2-family model, vocab 32000 — a single request carrying a pre-tokenized prompt with token id equal to the vocab size 32000 passes vLLM's input-id validation but is one past the last embedding...

ONNX: Denial Of Service Via Unchecked Expansion Of Packed Sub-byte Tensors In ONNX Python APIs

Summary ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor dimensions without verifying that a packed sub-byte payload contained the declared number of elements. A very small model could therefore cause a disproportionately large allocation...

Autobahn Python: Permessage-brotli Inflates A Whole Frame Before MaxMessagePayloadSize Is Checked (incomplete Fix Of GHS

Summary permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit brotli expands about 1,000,000:1. Any unauthenticated client can exhaust server memory this way on servers that...

Tornado: Quadratic CPU Usage When Parsing HTTP Headers With Line Folding

Summary Tornado's HTTP header parser takes quadratic time On² when a header value is continued across many "obsolete line folding" obs-fold lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the...

ONNX: Null Pointer Dereference In ScanInferenceFunction Due To Missing Required Attribute

Summary ONNX shape inference did not safely validate the required Scan "numscaninputs" attribute. Two malformed values could terminate or disrupt the process: 1. If the attribute was missing, "ctx.getAttribute"numscaninputs"" returned null and was dereferenced. 2. If the attribute was negative,...

Filelock: StrictSoftFileLock Follows A Symbolic Link Swapped In At <path>.filelock And Creates Claim Files In A Director

"StrictSoftFileLock" and "AsyncStrictSoftFileLock" check ".filelock" the coordination directory that holds the lock's state with one "lstat" call on its name. "lstat" reports what a name is without following a symbolic link a file that redirects to another path. After that check, the code reaches...

Filelock: ReadWriteLock Follows A Symlink At The Lock Path Into SQLite

Summary "ReadWriteLock" and "AsyncReadWriteLock" resolve the lock path with "pathlib.Path.resolve" and pass it to "sqlite3.connect" without refusing a symlink. A local user who can create names in the lock's directory, such as "/tmp" or a shared cache, can plant a symlink at the lock path and mak...

VLLM: Untrusted EPS Inputs Can Trigger Denial Of Service Or Ghostscript RCE

Summary In vLLM 0.30.0, "ImageMediaIO" passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled "image/png" reached the host's Ghostscript executable. On ...

Python Social Auth: OpenID Connect Nonce Is Not Bound To The Browser Session, So A Stolen Authorization Code Logs The At

Summary The generic OpenID Connect backend "OpenIdConnectAuth" and every backend built on it stores the "nonce" in the shared Association table, not in the user's session. When the ID token comes back, "validateclaims" only checks that the nonce exists in that table and is not expired. It does no...

VLLM DeepSeek-OCR Image Processing Vulnerable To Denial Of Service

Summary Any vLLM deployment serving a model of the DeepSeek-OCR family — "deepseek-ai/DeepSeek-OCR", "deepseek-ai/DeepSeek-OCR-2", or "baidu/Unlimited-OCR" whose "UnlimitedOCRForCausalLM" subclasses "DeepseekOCRForCausalLM" — can be killed by a single unauthenticated chat request carrying an...

Filelock: SoftFileLock Stale-lock Break Removes A Live Lock File On A Reused Inode Number And Admits Two Holders

The stale-lock break shared by "SoftFileLock", "MarkerSoftFileLock" and "SoftFileLease" and their async variants, and a "FileLock" that has fallen back to a soft lock on "ENOSYS", the "not implemented" error recognises the marker it judged stale by two values. The marker is the lock file at "",...

Filelock: SoftReadWriteLock Holder Refresh Writes Through A Hard Link And Hangs On A Named Pipe That Another Local User

"SoftReadWriteLock" and "AsyncSoftReadWriteLock", which wraps one refreshes its holder record the file under ".rw/holders/" that says a process holds or wants the lock on every poll of a waiting acquire and on every heartbeat the periodic refresh a holder runs to keep its record fresh. It does so...

Filelock ReadWriteLock: A Crafted Lock Database Makes Every Acquire Stall Or Hang Regardless Of Timeout

"ReadWriteLock" and "AsyncReadWriteLock" the SQLite-backed reader/writer lock run "PRAGMA journalmode=MEMORY" on a fresh connection for every acquire. That statement makes SQLite load the whole schema the "sqlitemaster" table, which lists every table and index with its "CREATE" text of whatever...

Filelock: Symlink Swap During SoftFileLock's Writability Check Leaks Whether A Path Exists And Is Writable By The Lock T

"raiseonnotwritablefile" is the check that "SoftFileLock" and the locks sharing its acquire path run before every attempt. It looks at the lock path with "os.lstat", so that it judges a planted symlink a file that points at another path by itself. When the node has no owner-write bit, it then cal...

Filelock: StrictSoftFileLock And SoftReadWriteLock Adopt A Protocol Directory Another User Created First, Losing Mutual

"StrictSoftFileLock", "AsyncStrictSoftFileLock", "SoftReadWriteLock" and "AsyncSoftReadWriteLock" keep their whole ownership state as files in a directory derived from the lock path ".filelock/claims", ".rw/gen,holders". When that directory already exists they adopt it after checking only that it...

LangGraph CLI Prints The Registry Push Token In `langgraph Deploy --verbose` Output

Summary "langgraph deploy --verbose" printed the temporary registry push token that the CLI uses to log Docker in to the deployment's image registry. Anyone who could read that output, for example in CI logs, could use the token until it expired. Details When Docker is available, "langgraph deplo...

Filelock: WindowsFileLock Ignores Mode: A 0o600 Lock File And The ReadWriteLock Database Inherit The Directory ACL

filelock on Windows ignores the "mode" argument. "FileLockpath, mode=0o600" creates the same file as "FileLockpath": one with no security descriptor of its own the Windows record that says who may access a file. Its access list, or ACL, is whatever the lock directory hands down to new files...

VLLM: Phi-4 Multimodal Audio Encoder Materializes And Retains Full Attention Matrices: A Single Max-length Audio OOM-cra

Summary The Phi-4 multimodal audio encoder "phi4mmaudio.py" / "phi4mmutils.py" runs its conformer attention in eager mode by default: the official HF config of "microsoft/Phi-4-multimodal-instruct" does not set "useptscaleddotproductattention", so the default "False" applies "phi4mmaudio.py:166",...

ONNX: Out-of-bounds Read In ConvTranspose Shape Inference Via Undersized Weight Rank

Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a "kernelshape" attribute. The inference function derived an empty "effectivekernelshape" vector from the undersized weight tensor, then...

Filelock: UnixFileLock Truncates And Chmods Any Regular File Another User Renames Or Hard-links Onto The Lock Path

"UnixFileLock", the backend of "FileLock" and "AsyncFileLock" on Unix, empties whatever regular file it finds at the lock path once it holds the "flock" a kernel lock on an open file. With an explicit "mode" it also chmods that file sets its permission bits, whether or not this acquire created it...

VLLM: Public Multimodal SHM Handle Forgery Reaches Worker-side `pickle.loads()` With Insecure Serialization Disabled

Affected - Ecosystem / package: pip / "vllm" - Affected versions: vLLM 0.32.0. Summary When "--mm-processor-cache-type shm" is enabled, vLLM's multimodal SHM cache represents a cached item with an "address" and "monotonicid" pair and treats that pair as authority to dereference shared memory in...

Filelock: StrictSoftFileLock Creates Its Claim Directories Without The Lock Mode, So Another Local User With A Write Bit

"StrictSoftFileLock" and "AsyncStrictSoftFileLock" apply the caller's "mode" to the sentinel the lock file at "" and to both claim files the files whose presence says a process wants or holds the lock. They create the two directories that hold the claims, ".filelock" and ".filelock/claims", with ...

Rucio Has An Authorization Bypass On REST API Endpoint For Signing URLs

Summary The "/credentials/signurl" endpoint decides authorization from the client-supplied "X-Rucio-Account" HTTP header instead of the authenticated token's account. Any client holding any valid auth token even a low-privilege account they legitimately own can send "X-Rucio-Account: root" to pas...

VLLM: DoS Via Unbounded Chat_template Jinja2 Rendering Exhausts The Renderer Thread Pool

Summary vLLM renders chat templates by passing the resolved Jinja2 source to "tokenizer.applychattemplate", which compiles and ".render"s it in an "ImmutableSandboxedEnvironment". The sandbox prevents code-execution escapes but imposes no wall-clock timeout, no output-size cap, and no nested-loop...

Mem0: Cross-tenant Conversation Leak Via Unescaped Delimiter Collision In Session-scope Key (_build_session_scope)

Summary buildsessionscope in mem0/memory/main.py builds the conversation-history scope key used to fetch/store the last N raw messages by naively joining caller-supplied userid/agentid/runid values with unescaped & and = delimiters: def buildsessionscopefilters: parts = for key in sorted"userid",...

ONNX: Out-of-Bounds Read In RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

Summary ONNX shape inference performed an out-of-bounds read when processing a malformed RNN, GRU, or LSTM node from opsets 1–6 whose first input had a rank other than three. "RNNShapeInferenceopset1to6" checked whether the input shape was present but accessed "dim0" and "dim1" without first...

LangGraph: Unencoded Identifiers In LangGraph SDK V3 Streaming Can Redirect Authenticated GET Requests

Summary The LangGraph Python SDK v3 streaming client interpolates caller-supplied "threadid" and "assistantid" values into request paths without encoding them at four synchronous and asynchronous call sites. Relative path segments can therefore redirect an authenticated GET request to another pat...

Opentelemetry-java: Quadratic CPU Consumption In W3C Tracestate Parsing

Summary OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted "tracestate" headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a followi...

Echo Has A Static Middleware Double-Unescape Path Traversal

Summary Commit a9ede66a PR 3006, issue 2599 silently fixed a path traversal vulnerability in the Echo web framework's static file middleware. Vulnerability The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally...

Echo Has Open Redirect Via Control-Character Prefix Defeating SanitizeURI

Summary Echo's dedicated open-redirect guard, "sanitizeURI", decides whether a redirect target is a local path by inspecting exactly two byte positions: "uri0" and "uri1". If the value begins with a control character such as a tab or a newline, followed by a separator pair, the guard does not fir...

Echo Has CSRF Protection Bypass Via MethodOverride Rewriting POST To Safe Method

Summary The "MethodOverride" middleware accepts any non-empty string as the override target method — including safe methods GET, HEAD, OPTIONS, TRACE — when rewriting a POST request. When "MethodOverride" is registered before "CSRF" in the post-routing middleware chain "e.Use", it rewrites the...

Echo Vulnerable To Reflected Cross-Site Scripting (XSS) Via Unsanitized JSONP Callback In Context.JSONP / Context.JSONPB

Summary The "Context.JSONP", "Context.JSONPBlob", and internal "jsonPBlob" helper in "context.go" directly concatenate the caller-supplied "callback" parameter into a JavaScript response without any validation, escaping, or allow-listing. This creates a high-impact reflected XSS that can be...

Echo: X-Real-IP Extractor Trusts The Header Value Instead Of The Sending Peer

Impact In Echo v5, "ExtractIPFromRealIPHeader" checked whether the address supplied in "X-Real-IP" belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by "c.RealIP" wi...

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP To Upstream By Default

Summary The Echo proxy middleware "middleware/proxy.go" preserves an incoming "X-Real-IP" header verbatim and forwards it to the upstream service when "EchoIPExtractor" is not configured — which is the default. Because any HTTP client can supply an arbitrary "X-Real-IP" value, an attacker can cau...

Echo Static File Middleware Route Protection Bypass Via Encoded Dot-dot Traversal

Summary Echo v5.2.0 contains a bypass of the fix for GHSA-vfp3-v2gw-7wfq. The fix rejects encoded path separators such as "%2F" and "%5C" before static file path unescaping, but two traversal forms still bypass route-level middleware protections for static files. The primary bypass uses encoded...

Echo's Middleware.Static: `%2F`-encoded Path Bypasses Route/group Middleware Guarding A Statically-served Path

Summary When "middleware.Static" is mounted globally "e.Usemiddleware.Static..." and an application relies on a route- or group-level middleware guard to restrict a path that also falls under the served static root, a "%2F"-encoded request bypasses that guard while the file is still served. This ...