nebula-mesh: Operator session tokens stored in plaintext in the database

CVE-2026-53603

## Impact Operator session tokens are stored in plaintext in the `operator_sessions` table (the `token` column is the P

历史摘要 · 未重新核验 · GitHub Advisory

nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

CVE-2026-53604

## Impact The web handler `renderMobileBundle` (`internal/web/handlers.go:1325`) passes the real `*pki.CAResolver` dire

历史摘要 · 未重新核验 · GitHub Advisory

Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

CVE-2026-54628

## Summary Anyquery's `server` mode does not restrict outbound HTTP requests initiated by its built-in SQLite virtual ta

历史摘要 · 未重新核验 · GitHub Advisory

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware

### Summary Ech0's i18n middleware runs on every HTTP request and constructs a fresh `*goi18n.Localizer` from the raw `

历史摘要 · 未重新核验 · GitHub Advisory

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

CVE-2026-54448

## Summary When Trivy scans a Helm chart archive (`.tgz`), its custom tar unpacker reads each entry with `io.ReadAll(tr

历史摘要 · 未重新核验 · GitHub Advisory

TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services

## Description The HTTP reverse proxy handler in tsdproxy does not strip the X-Forwarded-For (or X-Real-IP) header from

历史摘要 · 未重新核验 · GitHub Advisory

yutu: Arbitrary File Write via MCP `caption-download` Tool

CVE-2026-50158

## Arbitrary File Write via MCP `caption-download` Tool ### Summary The `caption-download` MCP tool in yutu passes the

历史摘要 · 未重新核验 · GitHub Advisory

Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation

CVE-2026-50141

### Impact A vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent

历史摘要 · 未重新核验 · GitHub Advisory

Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

CVE-2026-50006

## Summary Anyquery's `server` mode does not disable or restrict native SQLite disk manipulation commands. Unauthenticat

历史摘要 · 未重新核验 · GitHub Advisory

MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion

CVE-2026-50125

## Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion ### Summary The MK

历史摘要 · 未重新核验 · GitHub Advisory

Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

CVE-2026-50018

### Summary: Remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endp

历史摘要 · 未重新核验 · GitHub Advisory

Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode

CVE-2026-50013

### Summary: When Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map w

历史摘要 · 未重新核验 · GitHub Advisory

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

CVE-2026-54250

#### Summary A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files contai

历史摘要 · 未重新核验 · GitHub Advisory

TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation

## Description A vulnerability was discovered in TSDProxy where it forwards its internal per-process authentication tok

历史摘要 · 未重新核验 · GitHub Advisory

melange: Incomplete package integrity verification allows data section substitution

CVE-2026-54174

Previously, Apko verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified t

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

CVE-2026-50551

SiYuan v3.6.5 and earlier versions contain a stored cross-site scripting (XSS) vulnerability in the Attribute View (data

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

CVE-2026-54158

### Summary The attribute-view (database) cell renderer `genAVValueHTML` interpolates cell content raw in four of its b

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

CVE-2026-54088

## Overview The Hook Authentication feature in File Browser allows administrators to delegate login verification to an

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

CVE-2026-54070

## Summary `renderPackageREADME` in `kernel/bazaar/readme.go` renders a Bazaar package README from Markdown to HTML wit

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: Authentication Bypass via Proxy Auth Header Forgery

CVE-2026-54089

## Summary When FileBrowser is configured with proxy authentication (`auth.method=proxy`), any unauthenticated attacker

历史摘要 · 未重新核验 · GitHub Advisory