AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field

## Summary The `cleanUpString()` method in `ConfigWriter.php` uses an ungreedy regex to strip Liquidsoap string interpo

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass

CVE-2026-42606

## Summary The `ApplyXForwarded` middleware unconditionally trusts the client-supplied `X-Forwarded-Host` HTTP header w

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

CVE-2026-42605

## Summary The `currentDirectory` request parameter in the Flow.js media upload endpoint (`POST /api/station/{station_i

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root

## Summary OpenShell FS bridge writes stay pinned to the sandbox mount root. ## Affected Packages / Versions - Package:

历史摘要 · 未重新核验 · GitHub Advisory

changedetection.io project has an XXE vulnerability

CVE-2026-41895

# changedetection.io_XXE_01 Vulnerability Report: We discovered a XXE vulnerability in the changedetection.io project W

历史摘要 · 未重新核验 · GitHub Advisory

Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

CVE-2026-41893

## Summary The HTTP login endpoints (`POST /login` and `POST /signalk/v1/auth/login`) are protected by `express-rate-li

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

## Summary MCP loopback owner context is derived from server-issued bearer tokens. ## Affected Packages / Versions - Pa

历史摘要 · 未重新核验 · GitHub Advisory

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

CVE-2026-42311

### Impact Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrar

历史摘要 · 未重新核验 · GitHub Advisory

pyp2spec is Vulnerable to Code Injection

CVE-2026-42301

### Impact pyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without esca

历史摘要 · 未重新核验 · GitHub Advisory

Argo vulnerable to exposure of artifact repository credentials

CVE-2026-42295

### Summary The workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service acc

历史摘要 · 未重新核验 · GitHub Advisory

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

CVE-2026-42296

The fix for CVE-2026-31892 (commit 534f4ff) blocks `podSpecPatch` when `templateReferencing: Strict` is active, but does

历史摘要 · 未重新核验 · GitHub Advisory

Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

CVE-2026-42294

**Severity:** Medium **Component:** Webhook Interceptor (`server/auth/webhook`) **Vulnerability Type:** Denial of Servic

历史摘要 · 未重新核验 · GitHub Advisory

Argo has Missing Authorization in its Sync ConfigMap Provider

CVE-2026-42297

### Summary The Sync Service's ConfigMap-backed provider (`server/sync/sync_cm.go`) performs **zero authorization checks

历史摘要 · 未重新核验 · GitHub Advisory

A security flaw has been discovered in Totolink WA300 5.2cu.7112_B20190227. The affected element...

CVE-2026-7719

A security flaw has been discovered in Totolink WA300 5.2cu.7112_B20190227. The affected element is the function loginau

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issue affects the...

CVE-2026-7717

A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issue affects the function UploadCustomModul

历史摘要 · 未重新核验 · GitHub Advisory

Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi...

CVE-2026-42366

Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoV

历史摘要 · 未重新核验 · GitHub Advisory

A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision...

CVE-2026-42365

A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A

历史摘要 · 未重新核验 · GitHub Advisory

Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi...

CVE-2026-7371

Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoV

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was detected in Edimax BR-6208AC up to 1.02. Affected is an unknown function of...

CVE-2026-7685

A vulnerability was detected in Edimax BR-6208AC up to 1.02. Affected is an unknown function of the file /goform/setWAN.

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in Edimax BR-6428nC up to 1.16. This impacts an...

CVE-2026-7684

A security vulnerability has been detected in Edimax BR-6428nC up to 1.16. This impacts an unknown function of the file

历史摘要 · 未重新核验 · GitHub Advisory