free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating

CVE-2026-44328

### Summary free5GC's SMF mounts the `UPI` management route group without inbound OAuth2 middleware (same root cause as

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler

CVE-2026-44327

### Summary free5GC's NEF mounts the `nnef-oam` route group without inbound OAuth2/bearer-token authorization. A network

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions

CVE-2026-44326

### Summary free5GC's NEF mounts the `3gpp-traffic-influence` API without inbound OAuth2/bearer-token authorization. A n

历史摘要 · 未重新核验 · GitHub Advisory

free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types

CVE-2026-44325

### Summary free5GC's NRF root SBI endpoint `POST /oauth2/token` contains a parser-level type-confusion bug family. The

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)

CVE-2026-44324

### Summary free5GC's UDR `nudr-dr` `DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subs

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)

CVE-2026-44323

### Summary free5GC's UDR `nudr-dr` `DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subs

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference

CVE-2026-44322

### Summary free5GC's NEF `PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId}` handler pan

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)

CVE-2026-44321

### Summary free5GC's SMF mounts the `UPI` management route group without inbound OAuth2 middleware (same root cause as

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path

CVE-2026-44320

### Summary free5GC's NEF mounts the `nnef-callback` route group without inbound OAuth2/bearer-token authorization. A fo

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)

CVE-2026-44319

### Summary free5GC's NEF terminates the entire process when a stored PFD-subscription `notifyUri` cannot be reached. In

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions

CVE-2026-44318

### Summary free5GC's BSF `PUT /nbsf-management/v1/subscriptions/{subId}` handler has an unsynchronized write on the glo

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference

CVE-2026-44317

### Summary free5GC's PCF `POST /npcf-policyauthorization/v1/app-sessions` handler panics on a single authenticated requ

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference

CVE-2026-44316

### Summary free5GC's PCF `POST /npcf-smpolicycontrol/v1/sm-policies` handler (`HandleCreateSmPolicyRequest`) panics wit

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

CVE-2026-44315

### Summary free5GC's NEF mounts the `3gpp-pfd-management` API without inbound OAuth2/bearer-token authorization. A netw

历史摘要 · 未重新核验 · GitHub Advisory

gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits

CVE-2026-44309

## Summary `gitsign verify` and `gitsign verify-tag` re-encode commit/tag objects through go-git's `EncodeWithoutSignat

历史摘要 · 未重新核验 · GitHub Advisory

in-toto-golang and in-toto-python have inconsistent negation behavior

### Impact _What kind of vulnerability is it? Who is impacted?_ in-toto-golang and in-toto-python both support glob pat

历史摘要 · 未重新核验 · GitHub Advisory

Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size

CVE-2026-44247

### Impact The Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)

CVE-2026-44588

## Summary The tooltip mouseover handler in `app/src/block/popover.ts` reads `aria-label` via `getAttribute` and passes

历史摘要 · 未重新核验 · GitHub Advisory

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

## Summary Access tokens created with the "never expire" option have no `exp` JWT claim. Three independent revocation m

历史摘要 · 未重新核验 · GitHub Advisory

Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft

## Summary `parseAndValidateClientRedirect` at `internal/service/auth/auth.go:448` validates OAuth client-redirect URIs

历史摘要 · 未重新核验 · GitHub Advisory