OmniFaces: Forged combined-resource IDs and related output/push boundaries
## 1. Forged combined-resource IDs `CombinedResourceInfo` accepts a path-derived ID without an authenticity check, infla
2026-07-25 归档
今日共收录 771 条安全情报，包含 0 个 CVE，408 篇安全通告，以及 82 篇研究论文。
← 返回归档列表Shescape: Quadratic-time denial of service in the flag-protection
### Impact This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the
Shescape: Home-directory disclosure in assignment context on Unix with Dash
### Impact This impacts users of Shescape on Unix systems that explicitly configure `shell` to Dash, or `true` when the
Shescape: Shell injection via unescaped parentheses on Windows with CMD
### Impact This impacts users of Shescape on Windows that explicitly configure `shell` to CMD, or `true` with the defau
Shescape: Path disclosure on Unix with Zsh
### Impact This impacts users of Shescape on Unix systems that explicitly configure `shell` to Zsh, or `true` when the
OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
### Summary An authorization bypass vulnerability exists in the file sharing mechanism of `Openlist`. Due to a flawed, n
OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
### Summary An authorization bypass and information disclosure vulnerability exists in the search API of `Openlist`. Due
blaze: Unbounded WebSocket message aggregation in http4s-blaze-server
## Summary `http4s-blaze-server` aggregates the fragments of an incoming WebSocket message with no limit on total size
blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
### Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into `Request.headers`. Because trailer fields
Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover
## Preface Poweradmin maps OIDC identities into local users through `oidc_user_links.oidc_subject` plus `provider_id`.
Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own
## Affected software - Product: Poweradmin (web front-end for PowerDNS) - Version tested: master, commit 7f28c3a97 (als
Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account
### Summary The REST API user-update endpoint (`PUT/PATCH /api/v2/users/{id}` and the V1 equivalent) does not enforce t
vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review
### Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nod
Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics
## Summary `hubuum_client` diagnostics can expose sensitive request, response, import/export, task, delivery, or server
Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic
## Summary When an application configures hubuum_client with ClientBuilder::with_transport, several client operations s
Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects
## Impact The built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the init
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
### Summary `@anephenix/hub` starts a `setInterval` polling loop for every incoming WebSocket connection to request a c
Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources
## Summary Kite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified
Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes
### Summary pheditor's terminal feature restricts callers to an allowlist of commands (`TERMINAL_COMMANDS`) and rejects
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
## Summary The fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA