blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

## Summary `http4s-blaze-server` aggregates the fragments of an incoming WebSocket message with no limit on total size

历史摘要 · 未重新核验 · GitHub Advisory

blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

### Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into `Request.headers`. Because trailer fields

历史摘要 · 未重新核验 · GitHub Advisory

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

### Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser (`http/src/main/java/or

历史摘要 · 未重新核验 · GitHub Advisory

Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

## Preface Poweradmin maps OIDC identities into local users through `oidc_user_links.oidc_subject` plus `provider_id`.

历史摘要 · 未重新核验 · GitHub Advisory

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

## Affected software - Product: Poweradmin (web front-end for PowerDNS) - Version tested: master, commit 7f28c3a97 (als

历史摘要 · 未重新核验 · GitHub Advisory

Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

### Summary The REST API user-update endpoint (`PUT/PATCH /api/v2/users/{id}` and the V1 equivalent) does not enforce t

历史摘要 · 未重新核验 · GitHub Advisory

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

CVE-2026-14257

### Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not thei

历史摘要 · 未重新核验 · GitHub Advisory

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

### Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nod

历史摘要 · 未重新核验 · GitHub Advisory

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

## Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated r

历史摘要 · 未重新核验 · GitHub Advisory

@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

### Summary `@anephenix/hub` starts a `setInterval` polling loop for every incoming WebSocket connection to request a c

历史摘要 · 未重新核验 · GitHub Advisory

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

### Summary pheditor's terminal feature restricts callers to an allowlist of commands (`TERMINAL_COMMANDS`) and rejects

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

## Summary The fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: SSRF via DNS rebinding in the REST datasource integration

### Summary Budibase's central outbound-fetch guard (`fetchWithBlacklist`) prevents SSRF/DNS-rebinding by resolving the

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

## Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-le

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)

### Summary The Budibase AI chat-link handoff flow (`GET/POST /api/chat-links/:instance/:token/handoff`) binds an **ext

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster...

CVE-2026-17107

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption...

CVE-2026-66037

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF d

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write...

CVE-2026-66041

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc fil

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability...

CVE-2026-66038

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video de

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability...

CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decod

历史摘要 · 未重新核验 · GitHub Advisory