PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs

Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs Repo

历史摘要 · 未重新核验 · GitHub Advisory

ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

CVE-2026-53496

## Summary ExifReader 4.40.0 can throw an uncaught `RangeError: Offset is outside the bounds of the DataView` while par

历史摘要 · 未重新核验 · GitHub Advisory

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

CVE-2026-54567

## 1. Header | Field | Value | |---|---| | **Title** | Extension-denylist bypass via case-folding asymmetry in name-ove

历史摘要 · 未重新核验 · GitHub Advisory

Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

CVE-2026-53597

## Summary The TypeScript Prompty loader used `gray-matter` without overriding executable frontmatter engines. `gray-mat

历史摘要 · 未重新核验 · GitHub Advisory

Prompty: Arbitrary file read via file reference expansion

CVE-2026-53598

## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolv

历史摘要 · 未重新核验 · GitHub Advisory

mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath

CVE-2026-54561

### Impact `context_import` passed the caller-supplied `filePath` directly to `fs.readFileSync` with no path confinemen

历史摘要 · 未重新核验 · GitHub Advisory

sigstore-go: Multi-log threshold bypass via single compromised log

CVE-2026-49834

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransp

历史摘要 · 未重新核验 · OSV.dev

SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`

CVE-2026-49284

SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSA

历史摘要 · 未重新核验 · OSV.dev

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

CVE-2026-49852

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

历史摘要 · 未重新核验 · OSV.dev

Pimcore: CustomReports Share Bypass

CVE-2026-45704

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses i

历史摘要 · 未重新核验 · OSV.dev

Pimcore: SQL Injection in Custom Reports Column Configuration

CVE-2026-44739

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigActi

历史摘要 · 未重新核验 · OSV.dev

Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling

CVE-2026-45260

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV ass

历史摘要 · 未重新核验 · OSV.dev

Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration

Formie contains a missing authorization vulnerability in administrative settings routes. An authenticated, non-admin Cra

历史摘要 · 未重新核验 · GitHub Advisory

SQL injection in Amazon Athena Synapse connector

CVE-2026-12283

Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard

历史摘要 · 未重新核验 · OSV.dev

Gitea has insufficient permission checks for Composer package source links

CVE-2026-27771

### CVE Description Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package s

历史摘要 · 未重新核验 · GitHub Advisory

TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard

CVE-2026-54546

### Summary `PUT /api/basemap` (the basemap import endpoint) fetches an attacker-supplied URL server-side with **no SSR

历史摘要 · 未重新核验 · GitHub Advisory

Pimcore: WordExport Authorization Bypass for Unauthorized Document Export

CVE-2026-45703

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport expor

历史摘要 · 未重新核验 · OSV.dev

Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

CVE-2026-45162

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore loc

历史摘要 · 未重新核验 · OSV.dev

oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code

## Summary The vulnerability in oapi-codegen seems to be similar with CVE-2026-22785, which is a generated-code inject

历史摘要 · 未重新核验 · GitHub Advisory

meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

CVE-2026-54547

## X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token ### Summary `AuthInjectionMiddleware` in `meta-ads-

历史摘要 · 未重新核验 · GitHub Advisory