Free5GC AMF Bypasses UE Security Capabilities on NGAP PathSwitchRequest

CVE-2026-42081

### Summary The AMF in Free5GC v4.2.1 does not verify the UE Security Capabilities received in NGAP PathSwitchRequest me

历史摘要 · 未重新核验 · GitHub Advisory

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

CVE-2026-44503

### Summary The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9

历史摘要 · 未重新核验 · GitHub Advisory

Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

CVE-2026-41050

### Impact Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant

历史摘要 · 未重新核验 · GitHub Advisory

Rancher Extensions have arbitrary file access via path traversal

CVE-2026-25705

### Impact A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integr

历史摘要 · 未重新核验 · GitHub Advisory

Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure

### Summary [Amazon Elastic Container Service (Amazon ECS)](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/

历史摘要 · 未重新核验 · GitHub Advisory

Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme

CVE-2026-42597

## Summary The `/forms/chromium/convert/url` and `/forms/chromium/screenshot/url` routes accept `url=file:///tmp/...` f

历史摘要 · 未重新核验 · GitHub Advisory

Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

CVE-2026-42596

### Summary The default deny-lists used by Gotenberg's `downloadFrom` feature and `webhook` feature are bypassable. Beca

历史摘要 · 未重新核验 · GitHub Advisory

Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine

CVE-2026-42594

## Summary The webhook middleware spawns a goroutine that holds a reference to the request's `echo.Context` after the s

历史摘要 · 未重新核验 · GitHub Advisory

Goteberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes

CVE-2026-42593

## Summary Six conversion routes (`pdfengines/merge`, `pdfengines/split`, `libreoffice/convert`, `chromium/convert/url`

历史摘要 · 未重新核验 · GitHub Advisory

Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes

CVE-2026-42592

## Summary `FilterOutboundURL` resolves the hostname, checks the resolved IPs against the private-address deny-list, an

历史摘要 · 未重新核验 · GitHub Advisory

Gotenberg has a Server-Side Request Forgery (SSRF) Issue

CVE-2026-42591

### Summary The SSRF hardening shipped in v8.31.0 only covers outbound URLs that Gotenberg's Go code handles — Chromium

历史摘要 · 未重新核验 · GitHub Advisory

Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist

CVE-2026-42590

**Summary** The ExifTool metadata write blocklist in Gotenberg v8 can be bypassed using ExifTool's group-prefix syntax,

历史摘要 · 未重新核验 · GitHub Advisory

Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection

CVE-2026-42589

# Unauthenticated RCE in Gotenberg via Metadata Key Newline Injection ## Summary Gotenberg's `/forms/pdfengines/metada

历史摘要 · 未重新核验 · GitHub Advisory

ShellHub has crash-DoS via field injection in filter and sort-by parameters

CVE-2026-44425

## Summary The device list endpoint accepts user-controlled identifiers in two places that are passed directly as BSON/S

历史摘要 · 未重新核验 · GitHub Advisory

ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data

CVE-2026-44423

## Summary `GET /api/sessions/:uid` returns the full session object for any authenticated caller, without scoping by the

历史摘要 · 未重新核验 · GitHub Advisory

ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace

CVE-2026-44424

## Summary `GET /api/devices/:uid` returns the full device object whenever the caller is authenticated, without verifyin

历史摘要 · 未重新核验 · GitHub Advisory

axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

## Summary The AxonFlow SDK's `WebhookSubscription` (or equivalent) type did not expose the HMAC-SHA256 signing key ret

历史摘要 · 未重新核验 · GitHub Advisory

Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening

## Summary Eight independently-filed bug fixes in the v7.1.3 → v7.5.0 release window collectively close a set of multi-

历史摘要 · 未重新核验 · GitHub Advisory

authd: Primary group ID is incorrectly set to value of UID

CVE-2026-6970

authd 0.6.0 contains [a bug](https://github.com/canonical/authd/issues/1482) which can lead to an incorrect primary grou

历史摘要 · 未重新核验 · GitHub Advisory

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display

### Impact In the Prometheus server's legacy web UI (enabled via the command-line flag `--enable-feature=old-ui`), the

历史摘要 · 未重新核验 · GitHub Advisory