Server-Side Request Forgery (SSRF)

A2A Java SDK is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of push notification destination URLs and unrestricted redirect handling, which allows an unauthenticated attacker to make the server send HTTP requests to internal or restricted...

Hostname Verification Bypass

io.netty, netty-codec-classes-quic is vulnerable to a hostname verification bypass. The vulnerability is due to the improper handling of the SSLEngine by the BoringSSLCertificateVerifyCallback when using a plain X509TrustManager, which allows an attacker positioned on the network path to bypass...

Denial-Of-Service (DoS)

Netty's HttpServerCodec is vulnerable to denial-of-service DoS. The vulnerability is due to the unbounded growth of the methodOverflowQueue when processing pipelined HTTP/1.1 requests, which allows a remote, unauthenticated attacker to exhaust server memory by withholding reads on a single...

Virtualenv: Builtin Creation Follows Linked Environment Directories

Summary The builtin creator accepts existing directory symlinks through ensuredir and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as "ANT-2026-MUFJEG11" in "virtualenv-20261015-005", received on 1...

Virtualenv: Generated POSIX Console Launchers Interpret Destination Paths As Shell Syntax

Summary A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper...

Pillow: Heap Use-after-free When Encoding TIFF To An In-memory Buffer

Summary Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When "TIFFWriteScanline" fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, "TIFFClose" flushe...

Virtualenv: Deletion Recovery Can Change A Symlink Target's Mode

Summary The deletion error handler obtains permission bits with lstat but applies them through chmod, which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as "ANT-2026-UK90QC27" in "virtualenv-20261015-005...

HTTP Response Splitting

io.netty:netty-codec-http is vulnerable to HTTP response splitting. The vulnerability is due to incorrect pairing of outbound responses with inbound requests when processing 100 Continue informational responses, which allows an attacker to exploit pipelined HTTP/1.1 GET and HEAD requests with...

Vitest: Windows Backslash Traversal Bypasses The @vitest/mocker Redirect Allowlist Fix

Summary The path traversal fix released for "GHSA-82fw-gwwq-j7x9" https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9 can be bypassed on Windows by using a backslash in the redirect URL pathname. The fixed code joins an attacker-controlled URL pathname with the Vite root...

ApostropheCMS: Color Field Validation Bypass Allows Stored XSS Via HTML Appended After Rgb()/hsl() Prefix

Summary The color field accepts any string that begins with a valid "rgb" / "hsl" color, because "TinyColor.isValid" does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered ,...

HTTP Authority Confusion

io.netty, netty-codec-http3 is vulnerable to HTTP authority confusion. The vulnerability is due to the codec prioritizing the Host header over the authority specified in the absolute-form request-target, which allows a remote attacker to manipulate virtual-host routing, authorization checks,...

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id Bypasses ViewRole Restriction And Exposes ViewPermission-gated Fields

Summary The "getOne" REST endpoint for pages does not apply "viewRole" type-level restrictions or "viewPermission" field-level redaction. An editor-level user who knows a document "id" can read the full content of admin-only pages and their privileged fields, while the "getAll" endpoint correctly...

ApostropheCMS: Missing Authentication In `cleanExport` Route

1. Summary The API endpoint "POST /api/v1/@apostrophecms/import-export/clean-export" in "@apostrophecms/import-export" lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

Uncontrolled Recursion

Apache Thrift is vulnerable to uncontrolled recursion. The vulnerability is due to missing recursion depth limits in the Dart and Java ME bindings, where recursive calls can be triggered without bound and attackers can cause a stack overflow leading to denial of service...

ApostropheCMS: Unauthenticated PublicApiProjection Bypass Via Search And Sort Query Builders In The Public REST API

Summary ApostropheCMS lets a module expose an anonymous read API by setting "publicApiProjection", which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string before forcing that projection. Two of...

CPU Exhaustion

Neethi is vulnerable to CPU Exhaustion. The vulnerability is due to an exponential‑time algorithm in Neethi's policy‑intersection logic, where a specially crafted pair of WS‑Policy documents trigger the policy-intersection routine to perform exponential work, pinning the CPU for an extended perio...

Vitest: Code Injection Via Unauthenticated Manual Mock Registration

Summary "@vitest/mocker"'s "interceptorPlugin" accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's "url" into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place ...

Electron: HID And USB Permission Checks Can Be Attributed To The Wrong Origin

Impact For "hid" and "usb" permission checks made from an iframe, "session.setPermissionCheckHandler" was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the...

Vitest: Servers Misapply `server.fs.deny`, Serving `.env`, Private Keys, `.git`, And The API Token File

Summary In Vitest 5, Vite's "server.fs.deny" is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default such as ".env", private keys and certificates, ".npmrc", and ".git" or Vitest's own API token file ".vitest-secret-token" can be re...

Electron: HID And USB Permission Checks Can Be Attributed To The Wrong Origin

Impact For "hid" and "usb" permission checks made from an iframe, "session.setPermissionCheckHandler" was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the...

ApostropheCMS: Archive Duplicate Continuation Lets Contributors Overwrite Published Content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

Denial Of Service

Neethi is vulnerable to Denial of Service. The vulnerability is due to exponential re-expansion of repeated policy references during normalization, where the same references are re-expanded exponentially consuming huge amounts of CPU and memory, and attackers can supply a crafted WS-Policy docume...

Cross-Origin Interaction

Storybook is vulnerable to cross-origin interaction. The vulnerability is due to inadequate validation of iframe embedding and message origins, which allows an attacker to manipulate a running Storybook preview through a malicious website, modify story files, and potentially execute arbitrary cod...

ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken Discloses Existence Of Private/admin-only Content To Any Authen

Summary The "slugTaken" endpoint returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user including editors can enumerate the slug space of private pages, drafts, and archived content. Details "POS...

ApostropheCMS Sanitize-html: Unbounded Recursion When Re-sanitizing The Fallback Of A Discarded Iframe (stack Overflow,

Summary Since 2.18.0, when an "" is not allowed and "disallowedTagsMode" is "'discard'" the defaults, its raw-text content is re-sanitized by a recursive call to "sanitizeHtmltext, options" the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh stat...

ApostropheCMS: Import Archives Can Exhaust Server Storage And Deny Service

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

ApostropheCMS: Stored XSS Via Unescaped Widget Style Attribute Serialization

Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form "string" style field with a CSS "property" and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...

ApostropheCMS: Import API Bypasses Publication Roles For Protected Content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

OpenClaw: Browser CDP Discovery Could Accept Blocked WebSocket URLs

Summary Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy. This advisory is scoped to the named feature and configuration. It does not...

Virtualenv Bash Activate Runs Commands From An Environment Name With A Backslash Before $

Summary The bash "activate" script escapes the environment name for only one of the two passes bash makes over "PS1", so a backslash in the name undoes the escaping and a name containing "$..." runs as commands in the user's shell each time bash draws the prompt. Affected area...

Virtualenv Activate.fish Runs Commands From A Path Or Prompt With A Backslash Before A Quote

Impact "FishActivator" defines no "quote", so it inherits "ViaTemplateActivator.quote", which returns "shlex.quotestring". That function follows POSIX "sh" rules, where a backslash inside single quotes stays a literal character. fish reads "'" inside single quotes as an escaped quote and "\" as...

Virtualenv Activation Scripts Run Code From A Path That Contains A Placeholder Name

Impact "ViaTemplateActivator.instantiatetemplate" replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted...

Virtualenv Activate Runs Commands From The Environment Name In Zsh With PROMPT_SUBST

Impact zsh users activate an environment with the bash "activate" script, which puts the environment name into "PS1". Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when "BASHVERSION" is set, so zsh gets the raw value. With the "PROMPTSUBST" option...

OGNL Stricter-invocation Block List Bypass Via Java.lang.reflect Reflection Proxies

Summary OGNL's optional stricter invocation mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as "Runtime", "ProcessBuilder", and "ClassLoader". The block list filters on the declaring class of the method OGNL invokes. Because...

Coraza: URL-encoded Form Content-Type Parameters Bypass Coraza Body Inspection

Summary Coraza fails to inspect URL-encoded form bodies when their valid "Content-Type" contains a media-type parameter, for example: Content-Type: application/x-www-form-urlencoded; charset=UTF-8 An unauthenticated attacker can use this header to hide the complete form body from custom Coraza...

Coraza Body Processor Has A JSON Key Collision That Allows Unauthenticated Attackers To Bypass OWASP CRS Inspection

Summary Coraza's JSON body processor converts nested JSON properties into dot-separated "ARGSPOST" names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable An unauthenticated attacker can place a malicious...

Moov Signedxml: Unauthenticated Denial Of Service In Exclusive XML Canonicalization

Exclusive XML canonicalization "http://www.w3.org/2001/10/xml-exc-c14n" in "github.com/moov-io/signedxml" copied the entire accumulated namespace map at every node during "ValidateReferences", before any reference digest or signature check. For a chain of nested elements that each declare many...

Improper Authorization

github.com/openchoreo/openchoreo is vulnerable to an improper authorization. The vulnerability is due to improper validation of workflow run ownership labels in the update route, which allows an authenticated attacker with update permissions in the same namespace to modify another workflow run’s...

Coraza: Multipart Filename* (RFC 5987) Charset Restriction Lets A Decoy Filename Bypass FILES-based Rules

Summary Coraza extracts a multipart file upload's filename using Go's standard-library "mime.ParseMediaType", which only decodes the RFC 5987/6266 extended "filename" "Content-Disposition" parameter when its declared charset is exactly "us-ascii" or "utf-8". Any other charset — including...

Trigger.dev: Blind SSRF Via Alert-channel Webhook

Summary A WEBHOOK alert channel stores a user-supplied "url". When an alert fires deployment/run failure, error groups, the webapp server "alertsWorker" - "DeliverAlertService" POSTs the HMAC-signed alert payload to that URL via "fetchwebhook.url, ...". The URL is never validated against a host...

Adm-zip: Duplicate ZIP Entry Names: GetEntry() And ExtractAllTo() Resolve To Different Content

Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. "getEntryname" and "extractAllTo" walk these two different internal structures, so they can each resolve a duplicate name...

Trigger.dev: Trigger CLI Debug Deployment Logs Expose Resolved Environment Secret Values

Affected version: trigger.dev 4.5.3 4.5.6 was advertised by the CLI but was not tested. A staging dry-run executed with "trigger.dev deploy --env staging --dry-run --log-level debug". The debug output logged the complete build-worker options object. Its "envVars" property contained unredacted...

Adm-zip: GetDataAsync() Bypasses The MaxOutputLength Size Guard Enforced By The Synchronous GetData() Path

Summary adm-zip enforces a "maxOutputLength" guard against decompression bombs on its synchronous "getData" path, but the equivalent asynchronous "getDataAsync" path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry's declared size. An...

Trigger.dev: Cross-tenant SQL Injection In The TSQL Query Compiler (POST /api/v1/query) Via Unsanitized Window-function

Summary A cross-tenant SQL injection in the TSQL query compiler lets any authenticated trigger.dev customer read every other tenant's analytics data. The customer-facing query endpoint "POST /api/v1/query" accepts a TSQL/TRQL query that is compiled to ClickHouse SQL by "internal-packages/tsql". T...

ApostropheCMS: Unauthenticated Resource Exhaustion Via Pre-auth AposBigUpload Processing In @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by "@apostrophecms/import-export". The affected import API routes invoke: "self.apos.http.bigUploadMiddleware" before the actual import handler performs its authentication check...

Adm-zip: Unhandled Error Event In Async DEFLATE Decompression Crashes Node.js Process (DoS)

Summary Denial of Service in "adm-zip"'s async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file. Details Affected package: adm-zip Affected versions: at least 0.6.0 current latest; likely all versions containing...

Trigger.dev: Unauthenticated Realtime Stream Data Injection Via Run FriendlyId

Summary The POST handler for "/realtime/v1/streams/:runId/:streamId" has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: "apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts" The "actio...

Trigger.dev: Cross-environment Deployment Cancel

Summary Trigger.dev isolates each project into multiple environments "dev", "staging", "prod", and per-PR "preview" branches, each with its own secret API key — the environment is a trust boundary a "dev"/preview/CI key is lower-trust than a "prod" key. Most API routes enforce this by scoping...

League/commonmark: Denial Of Service Via Colliding Heading Slugs

Impact "UniqueSlugNormalizer::normalize" makes each slug document-unique by searching for an unused numeric suffix, but restarts that search from "1" on every collision. The k-th heading that collapses to the same base slug performs k−1 array lookups, so K colliding slugs cost Σk−1 = OK². An...

Vibe-Trading FastAPI Endpoints Permit Unauthenticated Access, File Upload, And An RCE Chain

Summary: 5 findings — unauthenticated full-API exposure F1, lead Critical, read-side authorization gap that persists even with "APIAUTHKEY" set F2, unauthenticated file write of ".py"/".sh"/".yaml" to a server-returned path F3, default-permissive CORS that combines with a loopback-only check to...