File Browser has a DoS Vulnerability via Public Login API

CVE-2026-54092

### Summary Unchecked passwords maximums allow for an arbitrarily large password to be passed into the login API. This s

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

CVE-2026-54096

### Summary This is similar vulnrability of **`CVE-2026-0035`**, which was fixed in Android `MediaProvider` with **high*

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix

CVE-2026-54097

### Summary A low-privileged authenticated user of filebrowser (with `create` + `delete` permissions in their own isolat

历史摘要 · 未重新核验 · GitHub Advisory

Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

CVE-2026-46371

### Summary A vulnerability in Fleet's Apple MDM commands listing endpoint allowed authenticated users with the lowest-

历史摘要 · 未重新核验 · GitHub Advisory

Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

CVE-2026-46370

### Summary A vulnerability in Fleet's labels host-listing endpoint allowed authenticated users with the lowest-privile

历史摘要 · 未重新核验 · GitHub Advisory

Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)

CVE-2026-53999

# Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) ## Su

历史摘要 · 未重新核验 · GitHub Advisory

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance

CVE-2026-11401

Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL. An issue in Aurora P

历史摘要 · 未重新核验 · GitHub Advisory

OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning

CVE-2026-48096

### Description In OpenFGA, when iterator caching is enabled, two distinct check requests can produce the same cache key

历史摘要 · 未重新核验 · GitHub Advisory

DevGuard has improper authorization on public assets

CVE-2026-48089

### Impact On a DevGuard API instance with one or more **public assets**, any authenticated user — including users from

历史摘要 · 未重新核验 · GitHub Advisory

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

CVE-2026-48050

### Summary Arc registers Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/ap

历史摘要 · 未重新核验 · GitHub Advisory

Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization

CVE-2026-48020

## Summary There is a high severity vulnerability in Traefik's `StripPrefix` middleware that allows an unauthenticated

历史摘要 · 未重新核验 · GitHub Advisory

free5GC UDR has improper `ueId` validation in EE subscription handlers that allows arbitrary identifier persistence

CVE-2026-47780

### Summary The free5GC UDR accepts arbitrary non-3GPP ueId values in the EE subscription creation and query flows becau

历史摘要 · 未重新核验 · GitHub Advisory

Dex: Token-exchange endpoint is missing AllowedConnectors enforcement

## Summary `server/handlers.go::handleTokenExchange` (lines 1804-1893) does not call `isConnectorAllowed(client.Allowed

历史摘要 · 未重新核验 · GitHub Advisory

Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

CVE-2026-47735

### Summary Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`) blocked only `read_parquet(` and `arc

历史摘要 · 未重新核验 · GitHub Advisory

nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

CVE-2026-47726

`internal/api/audit.go:12` — `handleGetAuditLog` does no admin check. The route is bearer-auth gated only; any operator

历史摘要 · 未重新核验 · GitHub Advisory

nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints

CVE-2026-47725

Every `/ui/*` POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. `SameSite

历史摘要 · 未重新核验 · GitHub Advisory

nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

CVE-2026-47724

The `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself adm

历史摘要 · 未重新核验 · GitHub Advisory

nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

CVE-2026-47723

None of the response paths in `internal/web/` or `internal/api/` set the standard browser-security headers. `grep` for `

历史摘要 · 未重新核验 · GitHub Advisory

nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

CVE-2026-47722

`internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields raw

历史摘要 · 未重新核验 · GitHub Advisory

Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin

CVE-2026-47252

# AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin | Field | Value | | --------------

历史摘要 · 未重新核验 · GitHub Advisory