blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

### Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into `Request.headers`. Because trailer fields

历史摘要 · 未重新核验 · GitHub Advisory

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

### Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser (`http/src/main/java/or

历史摘要 · 未重新核验 · GitHub Advisory

Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

## Preface Poweradmin maps OIDC identities into local users through `oidc_user_links.oidc_subject` plus `provider_id`.

历史摘要 · 未重新核验 · GitHub Advisory

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

## Affected software - Product: Poweradmin (web front-end for PowerDNS) - Version tested: master, commit 7f28c3a97 (als

历史摘要 · 未重新核验 · GitHub Advisory

Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

### Summary The REST API user-update endpoint (`PUT/PATCH /api/v2/users/{id}` and the V1 equivalent) does not enforce t

历史摘要 · 未重新核验 · GitHub Advisory

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

## Summary The forced password-change flow, triggered when the stored password is still the default (`admin`), does not

历史摘要 · 未重新核验 · GitHub Advisory

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

CVE-2026-14257

### Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not thei

历史摘要 · 未重新核验 · GitHub Advisory

swift-nio-http2: Missing CR/LF/NUL validation in header values

CVE-2026-64785

## Summary SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control

历史摘要 · 未重新核验 · GitHub Advisory

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

## Summary `sm-crypto` (npm package **0.4.0**, the latest release, published 2026-01-20) generates SM2 private keys and

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

## Summary Cloudreve exposes two admin node test endpoints under the `Admin.Read` OAuth scope. These endpoints accept a

历史摘要 · 未重新核验 · GitHub Advisory

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

### Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nod

历史摘要 · 未重新核验 · GitHub Advisory

Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics

## Summary `hubuum_client` diagnostics can expose sensitive request, response, import/export, task, delivery, or server

历史摘要 · 未重新核验 · GitHub Advisory

Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

## Summary When an application configures hubuum_client with ClientBuilder::with_transport, several client operations s

历史摘要 · 未重新核验 · GitHub Advisory

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

## Impact The built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the init

历史摘要 · 未重新核验 · GitHub Advisory

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

## Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated r

历史摘要 · 未重新核验 · GitHub Advisory

@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

### Summary `@anephenix/hub` starts a `setInterval` polling loop for every incoming WebSocket connection to request a c

历史摘要 · 未重新核验 · GitHub Advisory

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources

## Summary Kite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified

历史摘要 · 未重新核验 · GitHub Advisory

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

### Summary When a SASL PLAIN bind supplies an authorization identity (authzid) that resolves to a **different** user, P

历史摘要 · 未重新核验 · GitHub Advisory

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplie

历史摘要 · 未重新核验 · GitHub Advisory

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

### Summary pheditor's terminal feature restricts callers to an allowlist of commands (`TERMINAL_COMMANDS`) and rejects

历史摘要 · 未重新核验 · GitHub Advisory