Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty

## Summary Nezha v2.2.3 regresses the GHSA-9rc6-8cjv-rcvx host header injection fix for deployments where the new `dash

历史摘要 · 未重新核验 · GitHub Advisory

Netmaker has a boolean‑based SQL Injection

CVE-2026-32599

# SQL Injection in Netmaker SQLite Database Backend ## Summary The `sqliteDeleteRecord` function in Netmaker's databas

历史摘要 · 未重新核验 · GitHub Advisory

ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

CVE-2026-76081

### Summary A bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause

历史摘要 · 未重新核验 · GitHub Advisory

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

CVE-2026-56668

### Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to excha

历史摘要 · 未重新核验 · GitHub Advisory

ZITADEL: Auto-linking by email: IdP-side email verification is not checked

CVE-2026-56666

### Summary A flaw in the external identity provider handler allows unauthorized account linking to occur under specifi

历史摘要 · 未重新核验 · GitHub Advisory

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

CVE-2026-56665

### Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP)

历史摘要 · 未重新核验 · GitHub Advisory

Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

CVE-2026-88008

## Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 `Upgrade` mec

历史摘要 · 未重新核验 · GitHub Advisory

Traefik entrypoint header-name sanitization bypassed via request trailers

CVE-2026-88004

## Summary Traefik's entrypoint defenses against spoofed trusted header names — `aliasHeadersStrategy` / `underscoreHea

历史摘要 · 未重新核验 · GitHub Advisory

Traefik HTTP/3 Backend NTLM Connection Reuse

CVE-2026-88007

## Summary Traefik's HTTP/3 request path did not initialize the connection-scoped backend transport holder that isolate

历史摘要 · 未重新核验 · GitHub Advisory

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

CVE-2026-88009

## Summary Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form (for example `GET http

历史摘要 · 未重新核验 · GitHub Advisory

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

CVE-2026-88014

### Summary `backend/archive` mounts a zip file as a browsable, syncable rclone `Fs` (e.g. `rclone lsf :zip:downloaded.z

历史摘要 · 未重新核验 · GitHub Advisory

rclone: http backend forwards custom/auth headers to a different host on redirect

CVE-2026-88013

## Vulnerability Details **File**: `backend/http/http.go` **Lines**: 285 (client construction — no `CheckRedirect`), 50

历史摘要 · 未重新核验 · GitHub Advisory

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

CVE-2026-88016

## Summary With `-l/--links`, rclone's local backend recreates a source `.rclonelink` object as a real symlink at the de

历史摘要 · 未重新核验 · GitHub Advisory

rclone local: crafted Range request against a translated symlink panics (DoS)

CVE-2026-88015

### Summary When `backend/local` is used with `--links`/`-l` (or the `links=true` config option), each symlink is expose

历史摘要 · 未重新核验 · GitHub Advisory

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

CVE-2026-88018

### Summary `rclone serve s3`'s handler chain, when `--auth-proxy` is configured, is (outermost first): `authPairMiddlew

历史摘要 · 未重新核验 · GitHub Advisory

rclone: RC per-server auth-proxy bypass

CVE-2026-88044

## Summary `serve/start` accepts protocol options in a per-server `proxyOpt` object. The FTP and S3 RC adapters parse t

历史摘要 · 未重新核验 · GitHub Advisory

rclone: FTP cross-session auth-proxy backend confusion

CVE-2026-88017

## Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind t

历史摘要 · 未重新核验 · GitHub Advisory

rclone: source object names can escape the configured root on upload

CVE-2026-88046

### Summary Multiple backends, when given a specially crafted object to copy, can escape the backend confinement. | Ba

历史摘要 · 未重新核验 · GitHub Advisory

rclone: S3 multipart declared-length memory exhaustion

CVE-2026-88045

## Summary In streamed multipart mode, `serve s3` passes the request's declared part length to `multipart.NewRW().Reser

历史摘要 · 未重新核验 · GitHub Advisory

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

CVE-2026-84445

A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:a

历史摘要 · 未重新核验 · GitHub Advisory