GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

## Summary The fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

# Budibase: SSRF via bare fetch() in uploadUrl during AI table generation ## Summary The `uploadUrl()` function in `pa

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: SSRF via DNS rebinding in the REST datasource integration

### Summary Budibase's central outbound-fetch guard (`fetchWithBlacklist`) prevents SSRF/DNS-rebinding by resolving the

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

## Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-le

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Account Enumeration via Login Lockout Response Differential

## Summary The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticat

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)

### Summary The Budibase AI chat-link handoff flow (`GET/POST /api/chat-links/:instance/:token/handoff`) binds an **ext

历史摘要 · 未重新核验 · GitHub Advisory

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information...

CVE-2026-62835

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.

历史摘要 · 未重新核验 · GitHub Advisory

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown...

CVE-2026-57530

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milk

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster...

CVE-2026-17107

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption...

CVE-2026-66037

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF d

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write...

CVE-2026-66041

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc fil

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability...

CVE-2026-66038

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video de

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability...

CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decod

历史摘要 · 未重新核验 · GitHub Advisory

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin...

CVE-2026-57531

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allo

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability...

CVE-2026-66040

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and A

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability...

CVE-2026-66036

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

### Summary **This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p (PostgreSQL SQL injection

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

## Summary Budibase's MongoDB query execution endpoint (`POST /api/v2/queries/:queryId`) is vulnerable to NoSQL injecti

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

## Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and re

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

#### Summary The Budibase Worker service exposes a public, unauthenticated API endpoint (`GET /api/global/users/tenant/:

历史摘要 · 未重新核验 · GitHub Advisory