SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

## Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read` ### Summary The `web_url_read` MCP tool in m

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data

### Summary `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups

### Summary `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions

## Summary `network-ai`'s `ApprovalInbox` (`lib/approval-inbox.ts`) is a shipped, exported, documented feature — *"a we

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

### Summary `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment c

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

### Summary `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` fie

历史摘要 · 未重新核验 · GitHub Advisory

MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested

PathFilter's deny-list glob patterns are anchored, so `.git`, `.obsidian`, and `node_modules` were only blocked at the v

历史摘要 · 未重新核验 · GitHub Advisory

Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe

### Impact A stored cross-site scripting (XSS) vulnerability affected the Markdown/RichText field preview renderer in S

历史摘要 · 未重新核验 · GitHub Advisory

Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure

CVE-2026-55650

## Summary A Stored Cross-Site Scripting (XSS) issue previously existed in the Text Widget in Board of Outerbase Studio

历史摘要 · 未重新核验 · GitHub Advisory

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

CVE-2026-55660

TinaCMS registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and th

历史摘要 · 未重新核验 · GitHub Advisory

@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

CVE-2026-54074

## Description ### Summary `@tinacms/cli` contains a Remote Code Execution vulnerability in its Forestry-to-Tina migra

历史摘要 · 未重新核验 · GitHub Advisory

flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

CVE-2026-55091

### Summary `convert()` builds the nested tree by using each flat record's `id` and `parent` field values directly as

历史摘要 · 未重新核验 · GitHub Advisory

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument

CVE-2026-55849

## Summary A command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--wo

历史摘要 · 未重新核验 · GitHub Advisory

Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

CVE-2026-55591

### Summary signalk-server versions up to and including 2.27.0 contain a Server-Side Request Forgery (SSRF) vulnerabilit

历史摘要 · 未重新核验 · GitHub Advisory

gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)

CVE-2026-0755

Untrusted prompt input could reach the Gemini CLI @file parser, allowing read/exfiltration of arbitrary local files (@/e

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state

CVE-2026-53854

### Summary Internal/webchat command auth could inherit ownerAllowFrom wildcard state. In affected versions, a sender o

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Empty-scope device re-pairing could confuse caller scope containment

CVE-2026-53852

### Summary Empty-scope device re-pairing could confuse caller scope containment. In affected versions, a device re-pai

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Workspace-derived service PATH could influence trash command selection

CVE-2026-53865

### Summary Workspace-derived service PATH could influence trash command selection. In affected versions, a workspace-d

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots

CVE-2026-53858

### Summary Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. In affected versions, a wo

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Discord allowFrom could bind to mutable display names

CVE-2026-53849

### Summary Discord allowFrom could bind to mutable display names. In affected versions, a Discord account able to chan

历史摘要 · 未重新核验 · GitHub Advisory