Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS

CVE-2026-53522

## 1. Description The Nezha dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agent

历史摘要 · 未重新核验 · GitHub Advisory

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

CVE-2026-53519

### Summary `fallbackToFrontend` in the dashboard's `NoRoute` handler treats any URL whose **raw string** starts with `/

历史摘要 · 未重新核验 · GitHub Advisory

Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context

CVE-2026-53521

## Summary `PATCH /server/{id}` accepts and persists nonexistent `ddns_profiles` IDs for a member-owned server. If anot

历史摘要 · 未重新核验 · GitHub Advisory

Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

CVE-2026-53520

### Summary An authenticated non-admin user who owns any server can create or update a NAT profile whose `domain` is equ

历史摘要 · 未重新核验 · GitHub Advisory

regclient may leak authentication credentials to external blob stores

CVE-2026-49349

Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a maliciou

历史摘要 · 未重新核验 · GitHub Advisory

Authelia has an Edge Case Access Control Rule Mismatch

CVE-2026-48794

### Impact **CVSSv4 Baseline Score:** Low 2.4 **CVSSv4 Weighted Score:** Low 1.3 The full CVSSv4 Vector for this vuln

历史摘要 · 未重新核验 · GitHub Advisory

Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

### Summary In nezha **v1.14.13–v1.14.14** and **v2.0.0–v2.0.9**, the WebSocket endpoints `GET /ws/terminal/:id` and `G

历史摘要 · 未重新核验 · GitHub Advisory

Blnk has an API key authorization bypass in owner and scope enforcement

Blnk API key endpoints had an authorization issue that allowed non-master API keys to perform key-management actions out

历史摘要 · 未重新核验 · GitHub Advisory

golang.org/x/crypto/ssh: Invoking VerifiedPublicKeyCallback permissions skip enforcement

CVE-2026-46595

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of cal

历史摘要 · 未重新核验 · GitHub Advisory

golang.org/x/crypto/ssh/knownhosts vulnerable to auth bypass via unenforced @revoked status

CVE-2026-42508

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and

历史摘要 · 未重新核验 · GitHub Advisory

golang.org/x/crypto/ssh vulnerable to infinite loop on large channel writes

CVE-2026-39834

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload

历史摘要 · 未重新核验 · GitHub Advisory

golang.org/x/crypto/ssh: FIDO/U2F security key physical presence check can be bypassed

CVE-2026-39831

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did

历史摘要 · 未重新核验 · GitHub Advisory

golang.org/x/crypto/ssh: Invoking pathological RSA/DSA parameters may cause DoS

CVE-2026-39829

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessive

历史摘要 · 未重新核验 · GitHub Advisory

golang.org/x/crypto/ssh: Invoking client can cause server deadlock on unexpected responses

CVE-2026-39830

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection

历史摘要 · 未重新核验 · GitHub Advisory

golang.org/x/crypto/ssh: Invoking memory leak when rejecting channels can lead to DoS

CVE-2026-39827

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory gr

历史摘要 · 未重新核验 · GitHub Advisory

golang.org/x/crypto/ssh is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

CVE-2026-39835

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be c

历史摘要 · 未重新核验 · GitHub Advisory

golang.org/x/crypto/ssh vulnerable to invoking bypass of certificate restrictions

CVE-2026-39828

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were

历史摘要 · 未重新核验 · GitHub Advisory

golang.org/x/crypto/ssh: Invoking byte arithmetic causes underflow and panic

CVE-2026-46597

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafte

历史摘要 · 未重新核验 · GitHub Advisory

golang.org/x/crypto/ssh/agent doesn't drop invoking agent constraints when forwarding keys

CVE-2026-39832

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serializ

历史摘要 · 未重新核验 · GitHub Advisory

golang.org/x/crypto/ssh/agent doesn't enforce invoking key constraints

CVE-2026-39833

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enf

历史摘要 · 未重新核验 · GitHub Advisory