Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfo

## Summary The `fetchPeerConnectInfo` function in `internal/service/connect/connect.go:214-239` uses `httpUtil.SendReque

历史摘要 · 未重新核验 · GitHub Advisory

Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count

## Summary `PUT /api/echo/like/:id` at `internal/router/echo.go:12` is registered on `PublicRouterGroup` with no authen

历史摘要 · 未重新核验 · GitHub Advisory

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

### Summary **No authentication** is required to invoke **`PUT /api/echo/like/:id`**. The handler is registered on the

历史摘要 · 未重新核验 · GitHub Advisory

Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

## Summary The public RSS/Atom feed at `/rss` renders two attacker-controlled surfaces without HTML escaping. Tag names

历史摘要 · 未重新核验 · GitHub Advisory

Ech0 comment model's Email field returned on public /api/comments endpoints

## Summary The `Comment` model serializes its `Email` field through the public comment-listing API. `internal/model/com

历史摘要 · 未重新核验 · GitHub Advisory

Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery

CVE-2026-44523

#### Summary No minimum length or entropy is enforced on the `JWT_SECRET` configuration value. The application accepts

历史摘要 · 未重新核验 · GitHub Advisory

Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution

CVE-2026-44522

### Description The Note Mark application allows authenticated users to upload assets to notes via `POST /api/notes/{no

历史摘要 · 未重新核验 · GitHub Advisory

gittuf's policy can be rolled back to prior valid versions

CVE-2026-44544

## Summary An attacker with push access to gittuf's Reference State Log (RSL) can roll back the current policy to any p

历史摘要 · 未重新核验 · GitHub Advisory

FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)

## Summary FileBrowser Quantum serves inline SVG files without a `Content-Security-Policy` header, allowing embedded Ja

历史摘要 · 未重新核验 · GitHub Advisory

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion

CVE-2026-44542

### **Summary** Attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing trave

历史摘要 · 未重新核验 · GitHub Advisory

etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests

CVE-2026-44283

### Impact _What kind of vulnerability is it? Who is impacted?_ A vulnerability in etcd allows read access via PrevKv,

历史摘要 · 未重新核验 · GitHub Advisory

ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check

CVE-2026-44426

## Summary `GET /api/namespaces/:tenant` returns the full namespace object — including the members list (user IDs, e-mai

历史摘要 · 未重新核验 · GitHub Advisory

Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change

### Summary A session invalidation vulnerability exists in daptin's authentication system where JSON Web Tokens (JWTs)

历史摘要 · 未重新核验 · GitHub Advisory

Talos Linux has a local privilege escalation from untrusted workloads

### Summary A vulnerability in the Linux kernel's algif_aead subsystem (CVE-2026-31431, "copy.fail") allows an unprivil

历史摘要 · 未重新核验 · GitHub Advisory

Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users

CVE-2026-44514

### Summary Kubetail's dashboard exposes WebSocket endpoints that did not adequately validate the Origin header on conn

历史摘要 · 未重新核验 · GitHub Advisory

Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information

CVE-2026-42459

## Summary The free5GC UDM component fails to validate the `supi` path parameter in six GET handlers of the `nudm-sdm`

历史摘要 · 未重新核验 · GitHub Advisory

go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth

CVE-2026-42328

The DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply

历史摘要 · 未重新核验 · GitHub Advisory

Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI

CVE-2026-42083

### Summary PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handle

历史摘要 · 未重新核验 · GitHub Advisory

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

CVE-2026-42880

### Summary There is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an at

历史摘要 · 未重新核验 · GitHub Advisory

Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover

CVE-2026-42082

### Summary The AMF in Free5GC v4.2.1 does not enforce the concurrent security procedure rules defined in 3GPP TS 33.50

历史摘要 · 未重新核验 · GitHub Advisory