openhole-server vulnerable to path traversal via URL-decoded request path

CVE-2026-54650

## Summary openhole-server forwarded the URL-decoded request path (`r.URL.Path`) to tunnel clients instead of the origi

历史摘要 · 未重新核验 · GitHub Advisory

td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

CVE-2026-54638

### Impact A remote, unauthenticated attacker can cause excessive memory allocation (and resulting CPU / GC pressure, p

历史摘要 · 未重新核验 · GitHub Advisory

goshs has a Path Traversal issue

CVE-2026-66063

## Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write o

历史摘要 · 未重新核验 · GitHub Advisory

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

CVE-2026-64863

## Summary The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce `--no-delete` on the WebD

历史摘要 · 未重新核验 · GitHub Advisory

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)

CVE-2026-54719

GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete)

历史摘要 · 未重新核验 · GitHub Advisory

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

CVE-2026-62325

## Summary Start goshs v2.1.3 with `-b 'admin:' -sftp`. No `-fkf`. SFTP accepts connections without password. CVE-2026-

历史摘要 · 未重新核验 · GitHub Advisory

Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

CVE-2026-49446

### Summary The Constellation-tunnel bypass branch in `tokenMiddleware` at `src/proxy/routerGen.go:53-66` returns to th

历史摘要 · 未重新核验 · GitHub Advisory

Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

CVE-2026-49447

### Summary `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that s

历史摘要 · 未重新核验 · GitHub Advisory

Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape

CVE-2026-50568

`SanitizeFilePath` in `pkg/utils/utils.go` validated that a path stayed under a safe directory by calling `strings.HasPr

历史摘要 · 未重新核验 · GitHub Advisory

Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory

CVE-2026-50567

`Unarchive` in `pkg/utils/zip.go` joined each archive entry name with the destination directory via `filepath.Join` and

历史摘要 · 未重新核验 · GitHub Advisory

Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

CVE-2026-50569

`HTTPTriggerSpec.Validate()` validated `Methods`, `FunctionReference`, `Host`, `IngressConfig`, and `CorsConfig`, but si

历史摘要 · 未重新核验 · GitHub Advisory

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

CVE-2026-50570

Fission v1.24.0 added PodSpec safety validation for tenant-facing Environment and Function CRDs (`ValidatePodSpecSafety`

历史摘要 · 未重新核验 · GitHub Advisory

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

### Impact _What kind of vulnerability is it? Who is impacted?_ A network attacker who can reach an etcd TLS listener c

历史摘要 · 未重新核验 · GitHub Advisory

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

| Field | Value | |---|---| | Ecosystem | Go | | Package | `github.com/getkin/kin-openapi` | | Affected versions | `<= 0

历史摘要 · 未重新核验 · GitHub Advisory

etcd: Watch API authorization bypass via open-ended range requests

### Impact _What kind of vulnerability is it? Who is impacted?_ A user granted READ permission on a single, exact key c

历史摘要 · 未重新核验 · GitHub Advisory

Oh My Posh: Arbitrary command execution via template injection in the path segment

### Summary Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesyste

历史摘要 · 未重新核验 · GitHub Advisory

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

### Summary Oh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit

历史摘要 · 未重新核验 · GitHub Advisory

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

### Summary An authorization bypass vulnerability exists in the file sharing mechanism of `Openlist`. Due to a flawed, n

历史摘要 · 未重新核验 · GitHub Advisory

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

### Summary An authorization bypass and information disclosure vulnerability exists in the search API of `Openlist`. Due

历史摘要 · 未重新核验 · GitHub Advisory

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

### Summary The `/api/fs/batch_rename` handler validates and authorizes only the requested source directory. It rejects

历史摘要 · 未重新核验 · GitHub Advisory