Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

CVE-2026-88978

# Cross-tenant disclosure risk on `DurableTask` bidi RPC This is a low-severity, low-risk cross-tenant data exposure vu

历史摘要 · 未重新核验 · GitHub Advisory

Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

CVE-2026-84298

## Summary The V1 `DurableTask` stream handler registers worker-supplied durable task external IDs in an in-memory call

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses

CVE-2026-79913

**Summary** Cloudreve's server-side request forgery guard `ValidateExternalURL` (`pkg/request/ssrf.go`) resolves a user

历史摘要 · 未重新核验 · GitHub Advisory

Gardener: Authorization Bypass via Group Subject Injection

CVE-2026-79767

## Overview The `manage-members` custom verb authorization check in the Gardener API server's `customverbauthorizer` adm

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope

CVE-2026-77637

### Summary There is a privilege scope bypass in Cloudreve's admin API where two endpoints that mutate server state are

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

CVE-2026-77633

## Summary Cloudreve v4 splits the storage-quota **check** (reading the user's `used` bytes and comparing them to `MaxS

历史摘要 · 未重新核验 · GitHub Advisory

Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

CVE-2026-76805

A vulnerability in Nuclei's DAST/fuzz expression evaluation path allows a malicious target server to trigger disclosure

历史摘要 · 未重新核验 · GitHub Advisory

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

CVE-2026-76804

A vulnerability in Nuclei's workflow template loader allows `file:` protocol templates to execute without the `-file` fl

历史摘要 · 未重新核验 · GitHub Advisory

Nuclei: Local File Read via MySQL Client Sandbox Bypass

CVE-2026-76803

A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the `-allow-lo

历史摘要 · 未重新核验 · GitHub Advisory

Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass

CVE-2026-76802

A vulnerability in Nuclei's DAST template loading path allows unsigned `code:` protocol templates to execute, bypassing

历史摘要 · 未重新核验 · GitHub Advisory

Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability

CVE-2026-76819

A vulnerability in the Goja JavaScript engine used by Nuclei's `javascript:` protocol allows arbitrary native code execu

历史摘要 · 未重新核验 · GitHub Advisory

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

CVE-2026-77561

### Summary Tinyauth's login rate-limit bookkeeping can enter a global lockdown mode when its in-memory login-attempt m

历史摘要 · 未重新核验 · GitHub Advisory

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

CVE-2026-77560

# tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an aut

历史摘要 · 未重新核验 · GitHub Advisory

Tinyauth: User enumeration attack by timing oracle

CVE-2026-77582

### Summary It's possible to enumerate users through a timing oracle. In other words: I can easily check if a username e

历史摘要 · 未重新核验 · GitHub Advisory

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

CVE-2026-62371

## Impact The KubeEdge NodeUpgradeJob handler constructed the `keadm upgrade edge` command by concatenating the user-co

历史摘要 · 未重新核验 · GitHub Advisory

KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

CVE-2026-62370

## Summary KubeEdge CloudHub uses the viaduct packer to decode messages received from connected peers. The packer reads

历史摘要 · 未重新核验 · GitHub Advisory

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

CVE-2026-62369

## Description KubeEdge `keadm` contains a path traversal vulnerability in the `DecompressTarGz` archive extraction fun

历史摘要 · 未重新核验 · GitHub Advisory

OpenBao Skips Stricter Deny Policy for LIST operations

CVE-2026-63131

## Impact When a policy operator has written `capabilities = ["deny"]` on a path with a trailing wildcard but allowed a

历史摘要 · 未重新核验 · GitHub Advisory

Obot: Server-Side Request Forgery via remote MCP server URL

## Summary In affected versions, the URL of a remote MCP server is attacker-controlled at registration and is fetched s

历史摘要 · 未重新核验 · GitHub Advisory

Obot: MCP Registry API readable without authentication

## Summary In affected versions, enabling registry authentication (`OBOT_SERVER_ENABLE_REGISTRY_AUTH=true`) does not ac

历史摘要 · 未重新核验 · GitHub Advisory