Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

CVE-2026-42183

### Summary A nil pointer dereference in `server/auth/gatekeeper.go` `rbacAuthorization()` causes a panic (denial of ser

历史摘要 · 未重新核验 · GitHub Advisory

Argo has Missing Authorization in its Sync ConfigMap Provider

CVE-2026-42297

### Summary The Sync Service's ConfigMap-backed provider (`server/sync/sync_cm.go`) performs **zero authorization checks

历史摘要 · 未重新核验 · GitHub Advisory

Contras Affected by CopyFile Policy Subversion via Symlinks

### Impact The [Kata agent policies](https://docs.edgeless.systems/contrast/architecture/components/policies) generated

历史摘要 · 未重新核验 · GitHub Advisory

Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

CVE-2026-42461

### Summary Four `GET` endpoints under `/api/templates*` in Arcane's Huma backend are registered without any `Security`

历史摘要 · 未重新核验 · GitHub Advisory

auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation

CVE-2026-42560

### Summary The Patreon OAuth provider maps every authenticated Patreon account to the same local `user.ID`, instead of

历史摘要 · 未重新核验 · GitHub Advisory

ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction

### Impact Transactions were NOT committed despite the explicit `options.WithCommit` flag using table service client. Be

历史摘要 · 未重新核验 · GitHub Advisory

Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)

CVE-2026-40281

## Vulnerability Details **CWE**: CWE-20 - Improper Input Validation The metadata value sanitization introduced in v8.

历史摘要 · 未重新核验 · GitHub Advisory

Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL

CVE-2026-39383

# CVE Report — Unauthenticated SSRF via Unfiltered Webhook URL in Gotenberg ## Severity | Field | Value

历史摘要 · 未重新核验 · GitHub Advisory

Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection

CVE-2026-40280

## Vulnerability Details **CWE**: CWE-918 - Server-Side Request Forgery (SSRF) The default private-IP deny-lists for -

历史摘要 · 未重新核验 · GitHub Advisory

netfoil's optional seccomp sandboxing was not applied

### Summary The optional flag `--filter-system-calls` was not applied even if specified. ### Details This is a defense

历史摘要 · 未重新核验 · GitHub Advisory

Netfoil has incorrect allowlist enforcement

### Summary Rules could be bypassed by changing the first character: `example.com` could be be bypassed by e.g. `fxample

历史摘要 · 未重新核验 · GitHub Advisory

CoreDNS has TSIG authentication bypass on gRPC and QUIC transports

CVE-2026-35579

### Summary The gRPC, QUIC, DoH, and DoH3 transports in CoreDNS incorrectly handle TSIG authentication. For gRPC and Q

历史摘要 · 未重新核验 · GitHub Advisory

CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC

CVE-2026-33190

### Summary CoreDNS' tsig plugin can be bypassed on non-plain-DNS transports because it trusts the transport writer's Ts

历史摘要 · 未重新核验 · GitHub Advisory

CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass)

CVE-2026-33489

### Summary CoreDNS' transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone

历史摘要 · 未重新核验 · GitHub Advisory

CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification

CVE-2026-32936

### Summary CoreDNS's DNS-over-HTTPS (DoH) GET path accepts oversized `dns=` query values and performs substantial requ

历史摘要 · 未重新核验 · GitHub Advisory

CoreDNS' DoQ worker pool does not bound stream backlog

CVE-2026-32934

### Summary CoreDNS' DNS-over-QUIC (DoQ) server can be driven into large goroutine and memory growth by a remote client

历史摘要 · 未重新核验 · GitHub Advisory

Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters

CVE-2026-30246

### Summary Fiber cache middleware's default key generator uses only `c.Path()` and does not include the query string. A

历史摘要 · 未重新核验 · GitHub Advisory