Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

### Summary pheditor's terminal feature restricts callers to an allowlist of commands (`TERMINAL_COMMANDS`) and rejects

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

## Summary The fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: SSRF via DNS rebinding in the REST datasource integration

### Summary Budibase's central outbound-fetch guard (`fetchWithBlacklist`) prevents SSRF/DNS-rebinding by resolving the

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

## Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-le

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)

### Summary The Budibase AI chat-link handoff flow (`GET/POST /api/chat-links/:instance/:token/handoff`) binds an **ext

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster...

CVE-2026-17107

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption...

CVE-2026-66037

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF d

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write...

CVE-2026-66041

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc fil

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability...

CVE-2026-66038

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video de

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability...

CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decod

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability...

CVE-2026-66040

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and A

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability...

CVE-2026-66036

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

### Summary **This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p (PostgreSQL SQL injection

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

## Summary Budibase's MongoDB query execution endpoint (`POST /api/v2/queries/:queryId`) is vulnerable to NoSQL injecti

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

#### Summary The Budibase Worker service exposes a public, unauthenticated API endpoint (`GET /api/global/users/tenant/:

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution

## Impact A builder-level user can make Budibase issue server-side HTTP requests to loopback or private-network targets

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs

## Impact In Budibase v3.39.4, a regression in the authorization level for the S3 attachment upload endpoint allows any

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile

## Summary When creating a MongoDB datasource, Budibase passes the `tlsCertificateKeyFile` and `tlsCAFile` fields straig

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)

## Summary `POST /api/v2/email` on the account portal (`account.budibase.app`) starts an email-change workflow using a

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Privilege escalation via public role assignment API missing app-level authorization

### Summary Budibase `3.39.19` (commit `03fbabae4`) is affected by a privilege-escalation / missing-authorization flaw

历史摘要 · 未重新核验 · GitHub Advisory