AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

CVE-2026-63406

### Summary The telemetry subsystem embeds a hardcoded auth token (`"secret"`) in the public source and transmits raw CL

历史摘要 · 未重新核验 · GitHub Advisory

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

CVE-2026-63349

AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process()

历史摘要 · 未重新核验 · GitHub Advisory

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

CVE-2026-63374

### Impact Services using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made

历史摘要 · 未重新核验 · GitHub Advisory

AnyIO process-pool workers can block indefinitely on undrained stderr

CVE-2026-64847

### Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redi

历史摘要 · 未重新核验 · GitHub Advisory

Kyoo: OIDC login token can be redirected to an attacker-controlled URL

CVE-2026-77386

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker cou

历史摘要 · 未重新核验 · OSV.dev

AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body

CVE-2026-63405

### Summary The Pusher-compatible REST API includes `body_md5` in the HMAC signature string but never computes or verifi

历史摘要 · 未重新核验 · GitHub Advisory

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

CVE-2026-58197

## Summary A containerized MCP server running with the default `network` permission profile (`insecure_allow_all: true`

历史摘要 · 未重新核验 · GitHub Advisory

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

CVE-2026-61682

# Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any

历史摘要 · 未重新核验 · GitHub Advisory

Kyoo: Transcoder serves uncataloged files from the media directory

CVE-2026-77385

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core

历史摘要 · 未重新核验 · OSV.dev

zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

CVE-2026-61833

### Summary A bearer token with only `pull` and `push` scopes can successfully delete manifests and blobs from a zot re

历史摘要 · 未重新核验 · GitHub Advisory

Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation

CVE-2026-61795

### Summary A parameter order bug in `internal/webhook/tenant/validation/hostname_regex.go` causes the `hostnameRegexHa

历史摘要 · 未重新核验 · GitHub Advisory

Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

CVE-2026-61672

## Summary Capsule lets a cluster administrator forbid specific metadata keys that tenant owners must not place on thei

历史摘要 · 未重新核验 · GitHub Advisory

Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic

CVE-2026-61794

### Summary A validation bug in `internal/webhook/tenant/validation/forbidden_annotations_regex.go` allows an invalid `F

历史摘要 · 未重新核验 · GitHub Advisory

LMDeploy has an SSRF bypass

### Summary The URL checking logic in lmdeploy has a logical flaw that could be bypassed by attackers, leading to SSRF a

历史摘要 · 未重新核验 · GitHub Advisory

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

CVE-2026-33625

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 conta

历史摘要 · 未重新核验 · OSV.dev

LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory

CVE-2026-62278

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authen

历史摘要 · 未重新核验 · OSV.dev

LubeLogger: IDOR in DuplicateRecordsToOtherVehicles Allows Copying Records from Any User's Vehicle Without Ownership Check

CVE-2026-62279

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an aut

历史摘要 · 未重新核验 · OSV.dev

md-editor-v3: XSS via fenced-code language rendering bypass

CVE-2026-84992

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt()

历史摘要 · 未重新核验 · OSV.dev

PJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends)

CVE-2026-84975

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuT

历史摘要 · 未重新核验 · OSV.dev

PJSIP: Heap buffer overflow in the AVI parser

CVE-2026-77396

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser

历史摘要 · 未重新核验 · OSV.dev