stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)

### Summary On a multi-tenant stigmem node, a tenant administrator could list, read, and **admit or reject** quarantined

历史摘要 · 未重新核验 · GitHub Advisory

stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)

### Summary On a multi-tenant stigmem node, RTBF (right-to-be-forgotten) tombstones were mis-scoped two ways. (1) `issue

历史摘要 · 未重新核验 · GitHub Advisory

MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

### Impact If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. If the Unpacke

历史摘要 · 未重新核验 · GitHub Advisory

Gogs: XSS in .ipynb files renderer due to outdated notebookjs

### Summary Gogs renders Jupyter notebook files (`.ipynb`) using [jsvine/notebookjs](https://github.com/jsvine/notebook

历史摘要 · 未重新核验 · GitHub Advisory

SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`

## DNS-resolved Private Hostname SSRF in `web_url_read` ### Summary The `web_url_read` MCP tool in `mcp-searxng` is vu

历史摘要 · 未重新核验 · GitHub Advisory

SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

## Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read` ### Summary The `web_url_read` MCP tool in m

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

### Summary `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` fie

历史摘要 · 未重新核验 · GitHub Advisory

symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest

CVE-2026-55878

### Description The `ux:install` console command installs files from a recipe kit by copying paths listed in a `copy-fil

历史摘要 · 未重新核验 · GitHub Advisory

StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled

CVE-2026-55692

### Summary With $wgEmbedVideoRequireConsent enabled (the default), the urls for videos are stored in a json-ified data

历史摘要 · 未重新核验 · GitHub Advisory

Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat...

CVE-2026-47645

Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized atta

历史摘要 · 未重新核验 · GitHub Advisory

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft...

CVE-2026-32208

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)

历史摘要 · 未重新核验 · GitHub Advisory

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (...

CVE-2026-9375

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when u

历史摘要 · 未重新核验 · GitHub Advisory

Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows...

CVE-2023-54357

Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attacker

历史摘要 · 未重新核验 · GitHub Advisory

Langflow: Unauthenticated DoS through multipart form boundary file upload

CVE-2026-55446

### Summary An attacker can send a `/api/v1/files/upload/` request without any authentication token/cookies and abuse a

历史摘要 · 未重新核验 · GitHub Advisory

http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`

### Impact The `HmacSha256` class contained two functions: - `hash(payload)` — a plain unkeyed SHA-256 digest. The `Hma

历史摘要 · 未重新核验 · GitHub Advisory

VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files

### Summary vcrpy deserializes YAML cassette files with PyYAML's object-constructing loader (`yaml.CLoader` / `yaml.Loa

历史摘要 · 未重新核验 · GitHub Advisory

Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser

## XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser ### Summary `ultimate-sitemap-parser` version 1.8.0 a

历史摘要 · 未重新核验 · GitHub Advisory

Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit

## Gzip Decompression Bomb Bypasses Sitemap Size Limit ### Summary `ultimate-sitemap-parser` enforces a 100 MiB size l

历史摘要 · 未重新核验 · GitHub Advisory

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

CVE-2026-55660

TinaCMS registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and th

历史摘要 · 未重新核验 · GitHub Advisory

@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

CVE-2026-54074

## Description ### Summary `@tinacms/cli` contains a Remote Code Execution vulnerability in its Forestry-to-Tina migra

历史摘要 · 未重新核验 · GitHub Advisory