browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler

CVE-2026-49143

### Summary The HTTP handler `/_log` in `lib/server.js` (lines 491–515) of browserstack-runner passes unauthenticated u

历史摘要 · 未重新核验 · GitHub Advisory

browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server

CVE-2026-49144

## Summary The HTTP server in browserstack-runner serves files from the project directory via the `_default` handler. T

历史摘要 · 未重新核验 · GitHub Advisory

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

CVE-2026-42342

There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.

历史摘要 · 未重新核验 · GitHub Advisory

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

CVE-2026-42211

When using React Router v7 in [Framework Mode](https://reactrouter.com/start/modes#framework), there exists a combinatio

历史摘要 · 未重新核验 · GitHub Advisory

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

CVE-2026-40181

Certain URLs passed to the `redirect` function can trigger an open redirect to an external domain depending on the level

历史摘要 · 未重新核验 · GitHub Advisory

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

CVE-2026-33245

When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handl

历史摘要 · 未重新核验 · GitHub Advisory

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

CVE-2026-33244

When using React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework) with [Pre-rendering](https://

历史摘要 · 未重新核验 · GitHub Advisory

launch-editor vulnerable to command injection via the crafted request on Windows

CVE-2024-52011

### Summary Due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute a

历史摘要 · 未重新核验 · GitHub Advisory

Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

CVE-2026-47428

## Summary Vitest browser mode served `/__vitest_test__/` with the `otelCarrier` query parameter inserted directly into

历史摘要 · 未重新核验 · GitHub Advisory

When Vitest UI server is listening, arbitrary file can be read and executed

CVE-2026-47429

### Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the net

历史摘要 · 未重新核验 · GitHub Advisory

DOMPurify XSS via selectedcontent re-clone

CVE-2026-47423

### Summary DOMPurify 3.4.4 allows `selectedcontent` by default, allowing a chain in which browsers "re-clone" an XSS pa

历史摘要 · 未重新核验 · GitHub Advisory

@agenticmail/mcp Missing Authentication for Critical Function

# AgenticMail MCP HTTP authorization bypass ## Summary `@agenticmail/mcp` exposes a Streamable HTTP transport when sta

历史摘要 · 未重新核验 · GitHub Advisory

AgenticMail API/storage and outbound relay hardening fixes

CVE-2026-47255

The current upstream main branch at commit 7e0206d was reviewed, and the fix-first patch set was rebased on 2026-05-18.

历史摘要 · 未重新核验 · GitHub Advisory

Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers

CVE-2026-47248

### Impact Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through `Did you mean .

历史摘要 · 未重新核验 · GitHub Advisory

FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

CVE-2026-47717

### Summary The GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even w

历史摘要 · 未重新核验 · GitHub Advisory

LiquidJS is Vulnerable to Remote Code Execution

CVE-2026-45618

### Summary It is possible to execute arbitrary code with crafted templates ### Details `1|valueOf` -> `this` when

历史摘要 · 未重新核验 · GitHub Advisory

LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex

CVE-2026-45617

## Summary The built-in `strip_html` filter in liquidjs uses a regex containing four lazy-quantified alternatives. When

历史摘要 · 未重新核验 · GitHub Advisory

LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)

CVE-2026-45357

## Summary The `date` filter's strftime implementation parses width specifiers like `%9999999d` and forwards the captur

历史摘要 · 未重新核验 · GitHub Advisory

@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects

CVE-2026-44979

### Impact When `@hapi/wreck` follows a 3xx redirect to a different hostname, only the `Authorization` and `Cookie` head

历史摘要 · 未重新核验 · GitHub Advisory

@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters

CVE-2026-44974

### Impact The two parsers resolved duplicates inconsistently and silently: - `Content.disposition()` retained the last

历史摘要 · 未重新核验 · GitHub Advisory