Echo: HTTPS Redirect And HSTS Bypass Via Unconditional Trust Of Forwarded Scheme Headers

Description "Context.Scheme" unconditionally trusts four client-controlled HTTP headers to determine the request scheme, with no mechanism to configure trusted sources. This allows a remote unauthenticated attacker to bypass HTTPS redirect enforcement and suppress HSTS headers. The trusted header...

Echo Has Rate Limiter Bypass Via Spoofed X-Forwarded-For Header In Default Configuration

Summary When "echo.New" is used without explicitly setting "EchoIPExtractor", the "RealIP" method falls back to reading the client-supplied "X-Forwarded-For" or "X-Real-IP" header without any proxy-origin validation. The default "RateLimiter" middleware derives its per-client identifier from...

Echo Has Arbitrary Scheme Injection In WWWRedirect/NonWWWRedirect Middlewares Via X-Forwarded-Proto

Summary The "c.Scheme" method in Echo "context.go:162-181" trusts the "X-Forwarded-Proto", "X-Forwarded-Protocol", and "X-Url-Scheme" request headers without validating that the value is "http" or "https". The "WWWRedirect" and "NonWWWRedirect" middlewares use this unsanitized scheme to construct...

Ajenti Has Potential Remote Code Execution

Impact An unauthenticated user could gain access to a server to execute arbitrary code on this server. Patches This is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible...

Model Context Protocol Python SDK: Client Fetched Server-chosen $ref URLs While Validating Tool Results Against Output S

Summary In affected versions, when a connected MCP server declared an "outputSchema" for a tool, the SDK's client validated each "calltool" result with "jsonschema"'s default resolver, which fetches any "$ref" it cannot resolve locally by opening the URL. A server could therefore put an "http://"...

Fpdf2 Implicitly Loads External URLs And Local Image Paths When Rendering Attacker-controlled Content

Summary "fpdf2" implicitly dereferences image resource references supplied to rendering APIs. If an application passes untrusted HTML, SVG, template data, or image paths into those APIs, "fpdf2" may issue outbound HTTPS requests or attempt to open local filesystem paths. This behavior is relevant...

Rembg: Unauthenticated SAM Model Injection Permits Local-file Disclosure Through Malicious ONNX Graphs

The public "/api/remove" endpoint uses attacker-controlled "extras.sammodel" in both SAM filenames and GitHub download URLs. Path traversal plus a URL fragment lets an unauthenticated attacker place malicious ONNX models beside a target file. The models read the file as ONNX external data and...

Authlib: OpenID Implicit Grant Checks Raw Scope Instead Of Allowed Scope Before Issuing ID Tokens

Report metadata | Field | Value | | --- | --- | | Package | "authlib" PyPI, "pkg:pypi/authlib" | | Repository | https://github.com/authlib/authlib | | Component | "authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest" | | Vulnerability class | Authorization bypass: a...

MLflow Vulnerable To Arbitrary File Read On Unauthenticated Servers Via Prompt Model Version Source

Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in...

Authlib: Is_secure_transport() Loopback Exemption Can Be Bypassed With A Userinfo Component, Allowing Cleartext-HTTP URL

Summary "authlib.common.security.issecuretransport" is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback "http://" URIs. The check is implemented as a textual "str.startswith" prefix match, so ...

Twisted: DNS Response Spoofing In Twisted.names Due To Missing Source Address Validation

Summary "twisted.names.dns.DNSDatagramProtocol", the UDP transport used by twisted's DNS client "twisted.names.client.Resolver", "createResolver", and anything built on it, including MX lookups in "twisted.mail", accepts a DNS response for a pending query solely on the basis of the 16-bit...

MLflow CrewAI Autologging Records LLM Provider API Keys In Logged Trace Spans

Summary "mlflow.crewai.autolog" leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI "Agent" is instrumented with MLflow autologging, MLflow serializes the agent's "dict" and converts its fields to strings. The "llm" field contains the CrewAI LLM object, whose string...

MessagePack: Unbounded Memory Leak In Msgpack C Extension On Strict_map_key Validation Failure

Impact The msgpack-python C extension "msgpack.cmsgpack" leaks a decoded map value when deserialization rejects a key with "strictmapkey=True" the default. Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlle...

VLLM: Request-controlled Mm_processor_kwargs.code_revision Allows Remote Code Execution

Summary An untrusted multimodal request can set "mmprocessorkwargs.coderevision". When vLLM serves a model whose Hugging Face processor uses dynamic "automap" code and the operator enabled "--trust-remote-code", this request value reaches "AutoProcessor.frompretrained" and selects the Python...

GitPython: Separate_git_dir Leaks Env Vars Via Crafted .gitmodules Submodule Name

Summary "Repo.clone"'s handling of "separategitdir" never disables "Git.polishurl"'s environment-variable expansion, unlike every other caller of that helper that handles attacker-influenced data. Since "separategitdir" can be derived from an attacker-controlled ".gitmodules" submodule name, a...

Vllm P2p Never Connected Zmq_exhaustion

Summary When the "OffloadingConnector" uses "TieringOffloadingSpec" with a P2P secondary tier, an API client can submit many unique non-listening peer addresses through "kvtransferparams.prefill". vLLM keeps every never-established P2P session and its ZeroMQ sockets after the request finishes. On...

Authlib: Default JWT Bearer Grant Accepts Assertions For The Wrong Audience

Description Summary Authlib's default RFC 7523 JWT bearer grant leaves "getaudiences" empty, so "verifyclaims" only checks that an "aud" claim exists instead of requiring it to match the current authorization server's token endpoint. An attacker holding a legitimately issued JWT assertion for any...

GitPython Remote.pull() Refspec Bypasses The --upload-pack Unsafe-option Guard, Enabling Arbitrary Command Execution

Summary "Remote.pull" in GitPython forwards its positional "refspec" argument directly to the "git pull" child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the "refspec" for example a user-supplied branch or refspec...

Authlib: ID Token Can Disable Its Own Nonce Validation Via The Nonce_supported Claim

Summary "OpenIDMixin.parseidtoken" reads the "noncesupported" claim from the ID token it is validating. When that claim is boolean "false", the expected nonce is set to "None" and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session...

Authlib Accepts An Empty HMAC Key, Allowing JWS/JWT Signature Forgery (HS256/HS384/HS512)

Reporter: Cavan Loughran, Celvex Group Inc. Summary Authlib's symmetric oct key handling accepts an empty key empty bytes b'' / empty string '' as a valid HMAC signing and verification key. An empty HMAC key produces a deterministic digest that any party can reproduce, so an attacker who knows or...

Authlib Incomplete Algorithm-confusion Fix Permits HMAC Forgery With Prefixed Public Keys

Summary "OctKey.importkey" carries the only guard that stops an asymmetric public key from being used as an HMAC secret in "authlib.jose". That guard is "rawkey.startswithPOSSIBLEUNSAFEKEYS" — anchored at byte 0 — while the loader that consumes the identical bytes on the asymmetric path...

LiteLLM: Privilege Escalation To Proxy Admin Via Cross-Domain Reuse Of The Salt Key

Summary An authenticated user with "internaluser" privileges can escalate to "proxyadmin" and achieve remote code execution. The proxy uses one encryption key for two purposes: sealing secrets at rest and minting session tokens. An attacker exploits this by requesting a new API key with a crafted...

Model Context Protocol Python SDK: HTTP Client Transports Followed Cross-origin Redirects Carrying Custom Headers And Bo

Summary In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin: - custom headers set on the client for example an "X-API-Key" credential were sent to that origin,...

Denial Of Service (DoS)

Multer is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of asynchronous fileFilter callbacks after a request is aborted, which allows an attacker to trigger an unhandled stream error that terminates the Node.js process and disrupts application availability...

Dnspython Dns.name.from_wire_parser() Excessive CPU Use

Impact A maliciously crafted DNS message may cause dns.name.fromwireparser to use excessive CPU for DNS name decompression. Applications that process untrusted DNS wire form messages with dnspython may be degraded or DoS'd by the extra CPU use required. Patches This problem is fixed in dnspython...

OAuthLib: Bearer Token Can Be Retrieved As Long As Client Knows A Valid Client ID For Device Workflow

Summary A call to the token endpoint with a grant type of ""urn:ietf:params:oauth:grant-type:devicecode"" and a bogus "devicecode" is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details "Section 3.4 of the RFC 8628 spec"...

Snappy-java: JVM Crash From Unchecked Ranges In Snappy.arrayCopy And SnappyOutputStream.rawWrite

Impact "Snappy.arrayCopyObject src, int offset, int byteLength, Object dest, int destOffset" called a native "memcpy" without validating the ranges. A negative or oversized "byteLength" or offset read or wrote outside the arrays and crashed the JVM. "SnappyOutputStream.rawWrite" and...

Denial Of Service (Dos)

monai is vulnerable to denial-of-service. The vulnerability is due to pydicom's failure to validate Decimal String DS and Integer String IS values, which allows an unauthenticated remote attacker to upload a crafted DICOM file containing NaN or infinity values via the REST API...

Atlantis: OS Command Injection Through PR-controlled Terraform Workspace Enables RCE During Plan

Summary Atlantis passes the Terraform "workspace" value from a pull request's "atlantis.yaml" into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary command...

FileBrowser: Symlink Following Escapes User Scope Allowing Arbitrary File Read Outside The Served Directory

Summary File read paths resolve symbolic links with "filepath.EvalSymlinks" and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope for example to...

Go JOSE: DoS When Parsing JWKs That Contain RSA Keys

Summary A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. Details go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to "crypto/rsa.PrivateKey.Validate". On Go 1.24+, this takes cubic time...

Signature Verification Bypass

Authlib is vulnerable to a signature verification bypass. The vulnerability is due to the JsonWebSignature.deserializejson method accepting JSON Serialization JWS objects without verifying the signature or requiring a cryptographic key, which allows an attacker to provide unsigned payloads that a...

SiYuan: MCP File Tool's Blocklist Is Incomplete Relative To The HTTP File API It Claims To Align With, Exposing Publish-

Summary "kernel/mcp/tools/file.go"'s "resolvePath" includes an explicit comment stating its sensitive-path blocklist is meant to align with the HTTP file API's established blacklist "refuseToAccess" in "kernel/api/file.go", following the remediation for GHSA-cvhv-7xhj-xjp8 "Unauthenticated...

Neko: Authorization Bypass In Legacy WebRTC Input Handling

Impact When legacy mode is enabled and "session.implicithosting" is enabled, the legacy WebRTC data channel incorrectly authorizes input events due to a logic error in "LegacyIsHost". As a result, an authenticated room member may be able to send mouse and keyboard input through the legacy WebRTC...

Sandbox Bypass

Jenkins Script Security Plugin is vulnerable to sandbox bypass. The vulnerability is due to a failure to intercept operations on a null receiver, where method calls, property and attribute accesses, and array accesses are not checked, allowing attackers with permission to define and run sandboxed...

CKEditor: Cross-site Scripting (XSS) In The Engine Package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code...

CKEditor: Cross-site Scripting (XSS) In The Engine Package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the "es-toolkit" library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the...

Better-auth: OAuth Proxy Lets An Attacker Sign In As Another User

Am I affected? You may be affected if you use "better-auth" from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if all of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated "secret", or its "secret" equals...

Undici Vulnerable To Denial Of Service Via TLS 1.2 Certificate-changing Renegotiation

Impact undici crashes the client process when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the...

Better-auth: Device Login Approval Does Not Show The Requesting Client Or Permissions

Am I affected? You may be affected if you use "better-auth" from "1.3.8-beta.3" up to, but not including, "1.7.0-rc.3", and you enable the "deviceAuthorization" plugin. This range includes all 1.6 releases. You are affected only if all of these are also true: - An attacker can start a device...

Remote Code Execution (RCE)

MLflow is vulnerable to remote code execution RCE. The vulnerability is due to insufficient restriction of allowed Python modules, which allows an attacker to upload a malicious module into a writable allowed package and execute arbitrary code through the scorer invocation endpoint...

Cross-site Scripting (XSS)

serialize-javascript is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of closing-script prefixes in attacker-influenced function source text, which allows an attacker to terminate an HTML script element and inject malicious markup into the page by controlli...

Sandbox Bypass

Jenkins Script Security Plugin is vulnerable to sandbox bypass. The vulnerability is due to the plugin checking the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, where this...

Nodemailer: RFC 5322 Comment Inside An Angle-bracket Address Is Never Stripped

Summary Nodemailer's address parser has three published, patched fixes for RFC 5322 comment " ... " handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 comment glued two domain atoms into one, GHSA-g57g-f23g-4646 the same glue for a quoted local part, and the related ReDoS fixes GHSA-prgh-xp8r-p3m5...

Denial-of-service (DoS)

com.google.guava:guava is vulnerable to a denial-of-service DoS. The vulnerability is due to Java object deserialization eagerly allocating memory based on a caller-specified size without proper limits, which allows an attacker to exhaust available memory using crafted serialization streams and...

Undici WebSocket Client Vulnerable To Denial Of Service Via Unbounded Automatic PONG Buffering

Impact undici's WebSocket client including Node.js's bundled "globalThis.WebSocket" can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the receiver automatically writes a PONG response to the socket and ignores the "false" return...

Better-auth: OAuth State Can Be Used As A Magic Link To Sign In As Another User

Am I affected? You may be affected if you use "better-auth" from "1.4.0-beta.18" through versions before "1.7.7" with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default "storeToken: "plain"", or with...

Git-diff: OS Command Injection Vulnerability Via Crafted Strings To The GitDiff API

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

Qs : Qs.stringify With ArrayFormat 'comma' Throws An Uncaught TypeError On Array Elements Carrying A Non-callable Own To

Summary "qs.stringifyobj, arrayFormat: 'comma' " throws an uncaught "TypeError: Cannot convert object to primitive value" when an array in "obj" contains an element that carries an own, non-callable "toString" property for example " a: toString: 'x' ". A remote, unauthenticated attacker who can...

Undici Vulnerable To Denial Of Service Via Unhandled Exception In The Decompress Interceptor

Impact undici's "decompress" interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw. undici's engine converts a synchronous throw from a downstream handler into a per-request failure, but tha...