FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

CVE-2026-45062

### Summary The `splitPos()` function in [`cgi.go`](https://github.com/php/frankenphp/blob/main/cgi.go) misuses `golang

历史摘要 · 未重新核验 · GitHub Advisory

slack-go `SecretsVerifier` accepts empty signing secret without precondition

```go func NewSecretsVerifier(header http.Header, secret string) (SecretsVerifier, error) { hash := hmac.New(sha256.

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution

CVE-2026-45375

### Summary SiYuan's Bazaar (community marketplace) renders the `name` and `version` fields of a package's `plugin.json

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs

CVE-2026-45371

### Summary SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs `POST /api/graph/getGraph`, `P

历史摘要 · 未重新核验 · GitHub Advisory

uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution

CVE-2026-45152

I discovered a command injection vulnerability in uniget that allows arbitrary command execution through the metadata lo

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-mode

CVE-2026-45148

### Summary The advisory `GHSA-c77m-r996-jr3q` patched `getBookmark` so that, when invoked by a publish-mode `RoleReade

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Broken access control in `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

CVE-2026-45147

### Summary `POST /api/tag/getTag` is registered with `model.CheckAuth` only, omitting both `model.CheckAdminRole` and

历史摘要 · 未重新核验 · GitHub Advisory

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server

## Summary If you have the MCP Server ID, you can connect to the MCP server even if you don't have permissions to the s

历史摘要 · 未重新核验 · GitHub Advisory

Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

CVE-2026-44774

## Summary There is a medium severity vulnerability in Traefik's Kubernetes Gateway API provider that allows a tenant w

历史摘要 · 未重新核验 · GitHub Advisory

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

CVE-2026-44740

### Impact Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, un

历史摘要 · 未重新核验 · GitHub Advisory

Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload

CVE-2026-44697

## Summary A remote, unauthenticated denial-of-service vulnerability in `Batch.Decompress` (`data/batch/batch.go`) allo

历史摘要 · 未重新核验 · GitHub Advisory

esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files

CVE-2026-44594

### Summary A Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the `browser` field i

历史摘要 · 未重新核验 · GitHub Advisory

esm.sh: Legacy Route Path Traversal Can Lead to RCE

CVE-2026-44593

### Impact - Arbitrary File Write – An attacker can cause the server to write data to any file path it has write permiss

历史摘要 · 未重新核验 · GitHub Advisory

Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)

CVE-2026-45090

## Summary `ParameterAnalysis` in `pkg/scanning/parameterAnalysis.go` runs two sequential worker stages that both write

历史摘要 · 未重新核验 · GitHub Advisory

Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option

CVE-2026-45089

## Summary When dalfox is run in REST API server mode, the `output`, `output-all`, and `debug` fields in `model.Options

历史摘要 · 未重新核验 · GitHub Advisory

Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`

CVE-2026-45088

## Summary When dalfox is run in REST API server mode, the `custom-payload-file` field in `model.Options` is JSON-tagge

历史摘要 · 未重新核验 · GitHub Advisory

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`

CVE-2026-45087

# GHSA: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode ## Summary When dalfox is start

历史摘要 · 未重新核验 · GitHub Advisory

Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content

CVE-2026-45046

Gryph implements logging levels that determine what content is logged to a local sqlite database. The README incorrectly

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions

CVE-2026-44330

### Summary free5GC's NEF mounts the `nnef-pfdmanagement` route group without inbound OAuth2/bearer-token authorization.

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

CVE-2026-44329

### Summary free5GC's SMF mounts the `UPI` management route group without OAuth2/bearer-token authorization middleware.

历史摘要 · 未重新核验 · GitHub Advisory