SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

CVE-2026-55874

### Summary The SeaweedFS S3 API gateway did not reject `..` path segments in the `X-Amz-Copy-Source` header used by `Co

历史摘要 · 未重新核验 · GitHub Advisory

SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets

CVE-2026-55873

### Summary SeaweedFS routes requests signed with SigV4 service `s3tables` to the S3Tables management API. Authorization

历史摘要 · 未重新核验 · GitHub Advisory

klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply

CVE-2026-55764

## Summary On the SFT add-quantity path the only supply bound is `SFTAddCirculation`, which does `meta.Circulation += am

历史摘要 · 未重新核验 · GitHub Advisory

arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset

CVE-2026-55678

## Summary Arc Enterprise clustering accepts cluster join requests without authentication when `cluster.enabled=true` b

历史摘要 · 未重新核验 · GitHub Advisory

Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances

CVE-2026-55761

## Summary Portainer supports restoring an instance from a backup archive via the /api/restore endpoint. This endpoint i

历史摘要 · 未重新核验 · GitHub Advisory

klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits

CVE-2026-55763

## Summary In `processPercentageRoyaltiesTransfer` the royalty pool is collected from the sender by `SubFromBalance` tha

历史摘要 · 未重新核验 · GitHub Advisory

alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server

CVE-2026-55484

### Summary A single unauthenticated HTTP request to a path starting with `?` (e.g. `GET ? HTTP/1.1`) crashes the entire

历史摘要 · 未重新核验 · GitHub Advisory

Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

## Summary Crossplane allows package signature verification to be configured via the `ImageConfig` mechanism. When enab

历史摘要 · 未重新核验 · GitHub Advisory

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

CVE-2026-42350

## Summary The Kargo UI reads a `redirectTo` query parameter on the `/login` and `/token-renew` routes and, following a

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root

CVE-2026-54563

## Summary A Cloudreve WebDAV account stores a `uri` that defines the account's root folder. The WebDAV request handler

历史摘要 · 未重新核验 · GitHub Advisory

Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

CVE-2026-54523

## Summary In Kyverno v1.18.1, a tenant who can create a `NamespacedMutatingPolicy` in their own namespace can instruct

历史摘要 · 未重新核验 · GitHub Advisory

genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

CVE-2026-55637

`genieacs-mcp` exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled `Host` and `Origin` headers

历史摘要 · 未重新核验 · GitHub Advisory

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts

CVE-2026-55092

## Summary When Trivy downloads an OCI artifact, it uses the `org.opencontainers.image.title` annotation from the artif

历史摘要 · 未重新核验 · GitHub Advisory

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

CVE-2026-55677

### Summary Echo's router and static file handler disagree on URL path decoding. The router matches routes using the ra

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve's remote download file paths can escape the selected destination directory

### Summary Cloudreve trusts file paths returned by the configured remote downloader. A downloader-reported path such a

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint

## Summary Cloudreve's file-listing responses hand the client a `context_hint` (UUID) that is meant to speed up follow

历史摘要 · 未重新核验 · GitHub Advisory

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

CVE-2026-55477

# Summary An authenticated administrator can abuse the database import functionality to achieve arbitrary file write on

历史摘要 · 未重新核验 · GitHub Advisory

Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

gorilla/websocket used `math/rand` (cryptographically weak pseudo-random number generator) to generate WebSocket frame m

历史摘要 · 未重新核验 · GitHub Advisory

netfoil vulnerable to improper handling of untrusted DoH response data

### Summary HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data (which could conta

历史摘要 · 未重新核验 · GitHub Advisory

kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

CVE-2026-77354

### Summary An uncontrolled resource consumption vulnerability in `openapi3filter` lets any unauthenticated client forc

历史摘要 · 未重新核验 · GitHub Advisory