Echo: WebSocket proxy can retain connections and handlers after client disconnect

## Impact Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket cli

历史摘要 · 未重新核验 · GitHub Advisory

Echo: Decompress permits unbounded gzip expansion in v4

## Impact Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded si

历史摘要 · 未重新核验 · GitHub Advisory

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

## Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validatin

历史摘要 · 未重新核验 · GitHub Advisory

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

## Impact Echo v5's BodyDump middleware captured a bounded prefix, drained the remaining request body while ignoring re

历史摘要 · 未重新核验 · GitHub Advisory

Echo: BodyDump captures request and response bodies without size limits in v4

## Impact Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

CVE-2026-62204

## Summary `installBazaarPlugin` (and the equivalent endpoints for widgets/icons/templates/themes) accept `packageName`

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream

CVE-2026-73054

### Summary Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepali

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

CVE-2026-73630

### Summary `/api/filetree/authFilePublishAccess` is registered with `CheckAuth` only and is reachable anonymously. It

历史摘要 · 未重新核验 · GitHub Advisory

agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable

## Summary The MCP proxy's client-facing session ID embeds the authenticated caller's subject (JWT `sub` claim) specifi

历史摘要 · 未重新核验 · GitHub Advisory

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

CVE-2026-96627

## Summary A user holding the delegated `users:update` permission can reset the global administrator's password and take

历史摘要 · 未重新核验 · GitHub Advisory

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

CVE-2026-96628

## Summary Arcane v2.10.2 contains an authorization inconsistency in `AuthMiddleware.managerAuth`. When a request supp

历史摘要 · 未重新核验 · GitHub Advisory

kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

CVE-2026-100349

## Summary `ValidateResponse` panics on a nil pointer when a spec declares a response header with `content` instead of

历史摘要 · 未重新核验 · GitHub Advisory

CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

CVE-2026-62994

### Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configu

历史摘要 · 未重新核验 · GitHub Advisory

Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

CVE-2026-94603

### Impact Podman v4.4.0 added a feature where container checkpoints (from the `podman container checkpoint` command) co

历史摘要 · 未重新核验 · GitHub Advisory

SFTPGo source-side file-pattern filter bypass during copy operations

CVE-2026-103028

### Summary File pattern filters (`denied_patterns` / `allowed_patterns`) were evaluated on the destination of a copy o

历史摘要 · 未重新核验 · GitHub Advisory

containerd: Unpack DoS via repeated opaque whiteouts

CVE-2026-95838

### Impact A vulnerability exists in containerd's layer unpack handler where the processing of certain image layers cau

历史摘要 · 未重新核验 · GitHub Advisory

Distribution: Client `manifests.Get()` does not verify returned content against requested digest

CVE-2026-85747

### Summary `registry/client.(*manifests).Get(ctx, dgst, …)` fetches a manifest by digest but never hashes the returned

历史摘要 · 未重新核验 · GitHub Advisory

containerd CRI plugin: Checkpoint restore bypasses destination security context

CVE-2026-95837

### Impact A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint

历史摘要 · 未重新核验 · GitHub Advisory

kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

CVE-2026-100353

## Summary The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array sc

历史摘要 · 未重新核验 · GitHub Advisory

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

CVE-2026-100354

## Summary kin-openapi's spec loader and spec-time validator both handle circular schema references safely: the loader

历史摘要 · 未重新核验 · GitHub Advisory