Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

CVE-2026-71317

## Summary Repo under test: https://github.com/Netflix/lemur When `ADMIN_ONLY_AUTHORITY_CREATION=False` (an explicitly

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

CVE-2026-71308

## Summary Repo under test: https://github.com/Netflix/lemur The certificate create and upload endpoints accept a `rep

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

CVE-2026-71307

### Summary Lemur's destination read endpoints -- `GET /api/1/destinations` and `GET /api/1/destinations/` -- return the

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

CVE-2026-71303

### Summary The fix for GHSA-v2wp-frmc-5q3v added `_validate_acme_url()` to reject `acme_url` values not in `ACME_DIREC

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

CVE-2026-70667

## Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 (`_validate_revocation_url()` in `lemur /certificates/verif

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

CVE-2026-70666

### Summary The ACME client (used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs) connec

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

CVE-2026-62988

## Summary Several Froxlor API command classes return sensitive authentication material in JSON API responses. The affe

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection

CVE-2026-55593

## Summary The Froxlor AJAX endpoint (`lib/ajax.php`) is missing Cross-Site Request Forgery (CSRF) protection. While th

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

CVE-2026-54543

Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into gene

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

CVE-2026-54348

### Summary A second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

CVE-2026-54347

### Summary A stored Cross-Site Scripting (XSS) vulnerability in Froxlor's DNS editor allows an authenticated user with

历史摘要 · 未重新核验 · GitHub Advisory

devpi-server may leak database contents

CVE-2026-54723

### Impact If the replication protocol is enabled by using the ``primary`` (or deprecated ``master``) role for a server

历史摘要 · 未重新核验 · GitHub Advisory

MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

CVE-2026-55224

## Path Traversal via Unsanitized Identifier in Plugin Install/Uninstall ### Summary The app-store plugin service conca

历史摘要 · 未重新核验 · GitHub Advisory

MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files

### Summary The `NumpyReader` class in `monai/data/image_reader.py` unconditionally uses `np.load(name, allow_pickle=Tr

历史摘要 · 未重新核验 · GitHub Advisory

MONAI vulnerable to OS command injection

### Comment from JPCERT/CC We are submitting the report again as we have yet to receive any responses from you after sub

历史摘要 · 未重新核验 · GitHub Advisory

Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch

## Summary GHSA-89gg-p5r5-q6r4 claims the pickle deserialization vulnerability in `algo_from_pickle()` was fixed in

历史摘要 · 未重新核验 · GitHub Advisory

Triton VM Soundness Vulnerability due to Missing Constraint

The instruction `sponge_absorb_mem` Triton VM fails to verify that hashed values come from the claimed memory location.

历史摘要 · 未重新核验 · GitHub Advisory

jmespath.php has CompilerRuntime code injection via unescaped function names

CVE-2026-54133

## Impact `mtdowling/jmespath.php` can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime

历史摘要 · 未重新核验 · GitHub Advisory

membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

CVE-2026-53423

### Summary `membrane_mp4_plugin` interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, wit

历史摘要 · 未重新核验 · GitHub Advisory

surfio has an out-of-bounds read

CVE-2026-55211

### Impact Prior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer o

历史摘要 · 未重新核验 · GitHub Advisory