Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode

CVE-2026-81927

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processin

历史摘要 · 未重新核验 · OSV.dev

`tts-be` application has a Broken Access Control vulnerability

CVE-2026-88065

`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions

历史摘要 · 未重新核验 · OSV.dev

Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog

CVE-2026-81926

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's dupli

历史摘要 · 未重新核验 · OSV.dev

Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE

CVE-2026-88975

### Summary An unauthenticated peer can make Ember's HTTP/2 read loop hold 16 MiB of a single frame in memory on a conne

历史摘要 · 未重新核验 · GitHub Advisory

libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

CVE-2026-61544

### Summary `libp2p-quic` can panic on an inbound QUIC handshake if a malicious peer presents a valid, short lived libp

历史摘要 · 未重新核验 · GitHub Advisory

Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

CVE-2026-69201

The static content handlers `ResourceService` and `WebjarService` URL decode each path segment and then reject only segm

历史摘要 · 未重新核验 · GitHub Advisory

Http4s Ember HTTP/2: unbounded continuation frame accumulation

CVE-2026-69218

When Ember receives an HTTP/2 `HEADERS` or `PUSH_PROMISE` frame without the `END_HEADERS` flag, it buffers the header bl

历史摘要 · 未重新核验 · GitHub Advisory

Http4s: Ember chunk parser lenience (TE.TE request smuggling)

CVE-2026-69216

## Summary Ember's chunk decoder parses the size token leniently: it strips leading and trailing whitespace and accepts

历史摘要 · 未重新核验 · GitHub Advisory

Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

CVE-2026-69215

The `CookieJar` client middleware decides whether to attach a cookie to an outgoing request using an unanchored substrin

历史摘要 · 未重新核验 · GitHub Advisory

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

CVE-2026-69214

When processing a `Set-Cookie` from a response, the `CookieJar` client middleware trusts the server-supplied `Domain` at

历史摘要 · 未重新核验 · GitHub Advisory

Http4s Ember HTTP/2 has an unbounded outbound frame queue

CVE-2026-69213

Ember's HTTP/2 connection serializes all outgoing frames through a single unbounded queue drained by one writer fiber (`

历史摘要 · 未重新核验 · GitHub Advisory

Http4s: DigestAuth nonce map grows unbounded

CVE-2026-69208

The `DigestAuth` server middleware's stale-nonce cleanup uses an inverted comparison: it removes *fresh* nonces and stop

历史摘要 · 未重新核验 · GitHub Advisory

Http4s: DigestAuth allows replay of captured requests

CVE-2026-69206

The `DigestAuth` replay defence stores `lastNc + 1` rather than the nonce-count (`nc`) value it just accepted. When a le

历史摘要 · 未重新核验 · GitHub Advisory

Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

CVE-2026-69205

## Summary Ember's HTTP/1.1 header parser matches the `Transfer-Encoding` header value with a case-sensitive substring

历史摘要 · 未重新核验 · GitHub Advisory

Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

CVE-2026-69204

## Summary Ember's HTTP/1.1 request parser does not reject a message that carries both a `Transfer-Encoding` and a `Con

历史摘要 · 未重新核验 · GitHub Advisory

Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

CVE-2026-69203

An ember server with HTTP/2 enabled (`.withHttp2`) does not enforce `SETTINGS_MAX_CONCURRENT_STREAMS` on streams opened

历史摘要 · 未重新核验 · GitHub Advisory

Http4s Ember HTTP/2: unbounded inbound body buffering

CVE-2026-69202

Ember's HTTP/2 stack replenishes the inbound flow-control window based on bytes received off the wire, not bytes consume

历史摘要 · 未重新核验 · GitHub Advisory

Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty

## Summary Nezha v2.2.3 regresses the GHSA-9rc6-8cjv-rcvx host header injection fix for deployments where the new `dash

历史摘要 · 未重新核验 · GitHub Advisory

Netmaker has a boolean‑based SQL Injection

CVE-2026-32599

# SQL Injection in Netmaker SQLite Database Backend ## Summary The `sqliteDeleteRecord` function in Netmaker's databas

历史摘要 · 未重新核验 · GitHub Advisory

ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

CVE-2026-76081

### Summary A bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause

历史摘要 · 未重新核验 · GitHub Advisory