Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification

CVE-2026-46717

## Summary nezha's dashboard supports two user roles: `RoleAdmin` (Role==0) and `RoleMember` (Role==1). The notificatio

历史摘要 · 未重新核验 · GitHub Advisory

FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory

## Summary `publicPatchHandler` in `backend/http/public.go` joins user-controlled `fromPath` and `toPath` body fields w

历史摘要 · 未重新核验 · GitHub Advisory

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

CVE-2026-46703

#### Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI

历史摘要 · 未重新核验 · GitHub Advisory

BoxLite: Permission Bypass Allows Modification of Read-Only Files

CVE-2026-46695

#### Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch O

历史摘要 · 未重新核验 · GitHub Advisory

containerd user ID handling bypass allows runAsNonRoot evasion

CVE-2026-46680

### Impact A bug was found in containerd where containers launched with a numeric `User` directive that cannot be parsed

历史摘要 · 未重新核验 · GitHub Advisory

SpiceDB: Caveat structures with nested lists can result in improper cache reuse

CVE-2026-46668

### Impact Users are impacted if: - They have a caveat structure with a nested list, e.g.: ```zed caveat shape(x l

历史摘要 · 未重新核验 · GitHub Advisory

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

### Impact Unauthenticated denial of service. ### Summary When installing provider or module packages from attacker-co

历史摘要 · 未重新核验 · GitHub Advisory

Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

CVE-2026-46431

### Summary The SSE event server's `Access-Control-Allow-Origin` response header was hardcoded to the wildcard `*` rega

历史摘要 · 未重新核验 · GitHub Advisory

Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS

CVE-2026-46430

### Summary The SSE event server bound to `0.0.0.0:5553` on Linux/macOS by default because the platform-dependent host

历史摘要 · 未重新核验 · GitHub Advisory

Caddy Defender trusted proxy client IP bypass

CVE-2026-46415

### Impact Caddy Defender used `r.RemoteAddr` when evaluating whether a request should be blocked. `RemoteAddr` is the

历史摘要 · 未重新核验 · GitHub Advisory

FileBrowser Quantum: unauthenticated user share share info

CVE-2026-46410

### Impact Some sensitive info -- such as source and path can get exposed. ### Patches Update to the latest version ##

历史摘要 · 未重新核验 · GitHub Advisory

Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal

CVE-2026-46378

### Summary `dasel`'s selector lexer enters a non-terminating loop when tokenizing an unterminated regex pattern such a

历史摘要 · 未重新核验 · GitHub Advisory

Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

CVE-2026-46377

### Summary `dasel`'s selector lexer panics with an index-out-of-range error when tokenizing a quoted string that ends

历史摘要 · 未重新核验 · GitHub Advisory

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

CVE-2026-46354

## Summary `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but neve

历史摘要 · 未重新核验 · GitHub Advisory

Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint

CVE-2026-45796

## Summary Unauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (`POS

历史摘要 · 未重新核验 · GitHub Advisory

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

## Summary The MCP router (ext_proc) exposes an `initialize`-method code path that, when a request carries an `mcp-ini

历史摘要 · 未重新核验 · GitHub Advisory

GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

CVE-2026-45803

### Summary A security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence inject

历史摘要 · 未重新核验 · GitHub Advisory

Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching

## AI Disclosure I used an LLM to help review the source code, reason about attack surface, and help draft and refine

历史摘要 · 未重新核验 · GitHub Advisory

Caddy CVE-2026-30852 Fix Bypass

# ## TL;DR CVE-2026-30852 fixed double expansion in `vars_regexp` when the variable key is a placeholder (e.g. `{http

历史摘要 · 未重新核验 · GitHub Advisory

Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation

## Summary A vulnerability in the Kong Ingress Controller (KIC) allows for the unauthorized exfiltration of TLS certifi

历史摘要 · 未重新核验 · GitHub Advisory