kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

CVE-2026-76905

### Summary A nil-pointer dereference in `openapi3filter.ConvertErrors` lets any unauthenticated client crash a server

历史摘要 · 未重新核验 · GitHub Advisory

Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation

CVE-2026-64679

### Summary Atlantis versions `>= 0.19.8` and `< 0.45.0` did not consistently validate user-controlled `workspace` value

历史摘要 · 未重新核验 · GitHub Advisory

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

CVE-2026-67448

## Summary The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test,

历史摘要 · 未重新核验 · GitHub Advisory

Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

CVE-2026-67447

## Summary Mailpit's SMTP DATA reader enforces the configured `MaxMessageSize` only after `bufio.Reader.ReadBytes('\n')

历史摘要 · 未重新核验 · GitHub Advisory

Fleet: ORDER BY column injection on activity list endpoints

### Summary An authenticated user with read access to Activity could influence the `ORDER BY` clause of the activity li

历史摘要 · 未重新核验 · GitHub Advisory

Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs

### Summary Two endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reacha

历史摘要 · 未重新核验 · GitHub Advisory

BuildKit has a possible runtime DoS via unbounded group parsing

CVE-2026-61712

### Impact Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a contai

历史摘要 · 未重新核验 · GitHub Advisory

BuildKit: Custom frontend could bypass Seccomp/AppArmor

CVE-2026-61711

### Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the b

历史摘要 · 未重新核验 · GitHub Advisory

Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS

CVE-2026-53941

## Summary An unprivileged container can block all other containers from starting on the same host by placing a crafted

历史摘要 · 未重新核验 · GitHub Advisory

moby/go-archive: Crafted tar archive can write outside the extraction directory

CVE-2026-17106

### Summary The tar extraction routines in `moby/go-archive` (`Unpack`, `UnpackLayer`, `Untar`/`UntarUncompressed`, and

历史摘要 · 未重新核验 · GitHub Advisory

package pkcs12: Authentication bypass in Decode functions

`Decode`, `DecodeChain`, `DecodeTrustStore`, and `ToPEM` can incorrectly accept PKCS#12 files which were encoded with th

历史摘要 · 未重新核验 · GitHub Advisory

uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

## Summary The sigstore check on `metadata.json` is gated on the wrong side of the condition. `LoadMetadata` in `intern

历史摘要 · 未重新核验 · GitHub Advisory

uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

CVE-2026-55062

### Summary Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary f

历史摘要 · 未重新核验 · GitHub Advisory

uniget CLI has an EDITOR Command Injection

CVE-2026-55061

### Summary The uniget CLI has a command injection vulnerability in [hooks.go](vscode-file://vscode-app/app/extra/vscode

历史摘要 · 未重新核验 · GitHub Advisory

Beyond Single-Vulnerability Evaluation: Closing the Engineering Decision Gap Between C Retrofits and Native Safety

本文针对C语言内存安全加固研究中普遍存在的“单漏洞类孤立评估”问题，提出了一种全新的跨语言比较评估范式。过去数十年，研究者提出了许多针对C语言的内存安全回填机制，但这些机制几乎总是在孤立条件下、针对特定漏洞类型进行评估，导致实际工程实践中难

历史摘要 · 未重新核验 · arXiv cs.CR

Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter

CVE-2026-53658

When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP ui

历史摘要 · 未重新核验 · GitHub Advisory

Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket

CVE-2026-53657

### Impact On an instance of Lima running with `qemu` driver, an arbitrary user in the VM could access `/run/lima-guesta

历史摘要 · 未重新核验 · GitHub Advisory

Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

CVE-2026-35511

The OAuth callback handler links incoming OAuth identities (Google, GitHub, etc.) to existing accounts matched by email

历史摘要 · 未重新核验 · GitHub Advisory

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

CVE-2026-54526

### Summary The allow-list fix for CVE-2026-31892 (GHSA-3wf5-g532-rcrr), and its follow-up coverage of `hostNetwork`/`s

历史摘要 · 未重新核验 · GitHub Advisory

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

CVE-2026-54917

## Summary The S3 API gateway and the Iceberg REST catalog gateway construct their routers with `mux.NewRouter().SkipCl

历史摘要 · 未重新核验 · GitHub Advisory