Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes: - **Weak RNG for tokens (CWE-330):** author/sessio

历史摘要 · 未重新核验 · GitHub Advisory

vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

### Summary: The `bufferAllocLimit` defense (GHSA-6785-pvv7-mvg7) can be completely bypassed using `ArrayBuffer`, `Shar

历史摘要 · 未重新核验 · GitHub Advisory

vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

# NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sib

历史摘要 · 未重新核验 · GitHub Advisory

vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

CVE-2026-47698

### Summary VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape fro

历史摘要 · 未重新核验 · GitHub Advisory

VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

CVE-2026-47686

**Affected:** vm2 { throw new Error('fail', { cause: process }); } } }); const result = vm.run

历史摘要 · 未重新核验 · GitHub Advisory

vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

CVE-2026-47683

## Summary vm2 bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike The `bufferAllocLimit` option

历史摘要 · 未重新核验 · GitHub Advisory

Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

CVE-2026-55156

# Unauthenticated Path Traversal in Dashboard Session Log API Endpoints | Field | Value | | ----------------

历史摘要 · 未重新核验 · GitHub Advisory

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

CVE-2026-55157

### Summary `token-optimizer-mcp` is vulnerable to OS command injection in the `smart_user` tool. The `get-user-info`

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

CVE-2026-35219

## Summary Budibase automation steps (outgoing webhook, Zapier, n8n, Slack, Discord, Make.com) make server-side HTTP re

历史摘要 · 未重新核验 · GitHub Advisory

Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

CVE-2026-73654

## Summary The run-metadata update endpoint `PUT /api/v1/runs/:runId/metadata` applies client-supplied "operations" by

历史摘要 · 未重新核验 · GitHub Advisory

hashi-vault-js: Vault token and secret values exposed in thrown errors

CVE-2026-55102

## Summary Vault token and secret values are exposed in thrown errors when using `hashi-vault-js`. ## Details Every A

历史摘要 · 未重新核验 · GitHub Advisory

ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

CVE-2026-55088

Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext autho

历史摘要 · 未重新核验 · GitHub Advisory

ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

CVE-2026-55086

## Description `src/node/handler/ImportHandler.ts` and `src/node/handler/ExportHandler.ts` both compute their temporary

历史摘要 · 未重新核验 · GitHub Advisory

ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

CVE-2026-55087

# GHSA-03 — `x-proxy-path` header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect

历史摘要 · 未重新核验 · GitHub Advisory

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

CVE-2026-71851

### Summary `CryptoJS.lib.WordArray.random()` in affected versions is not a cryptographically secure random number gene

历史摘要 · 未重新核验 · GitHub Advisory

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

CVE-2026-71850

### Summary `memo()` from `hono/jsx` retains the result of a server-side render and reuses it for later renders with co

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Proxy Helper does not remove response headers listed in the `Connection` header

CVE-2026-71849

### Summary The Proxy Helper (`hono/proxy`) does not remove response headers named by the origin's `Connection` header.

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Algorithmic Complexity DoS in Language Middleware

CVE-2026-71848

### Summary The `languageDetector` middleware is vulnerable to algorithmic complexity denial of service when processing

历史摘要 · 未重新核验 · GitHub Advisory

jsii-diff: Command Injection via npm: package argument

CVE-2026-15895

## Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report erro

历史摘要 · 未重新核验 · GitHub Advisory

SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

CVE-2026-66062

### Impact SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted `Accept` headers. The i

历史摘要 · 未重新核验 · GitHub Advisory