zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

CVE-2026-115909

### Summary The symbolic-link branch of `ZipArchive::extract_internal()` allocates a buffer using an attacker-declared

来源摘录 · GitHub Advisory

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

CVE-2026-63414

In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify

来源摘录 · GitHub Advisory

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

CVE-2026-62290

## Summary `Challenge` resources under `acme.cert-manager.io` can be created directly by namespace users. On create, ce

来源摘录 · GitHub Advisory

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

CVE-2026-9086

### Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with

来源摘录 · GitHub Advisory

Keycloak vulnerable to authorization bypass via incorrect uri comparison

CVE-2026-9800

### Description A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass

来源摘录 · GitHub Advisory

@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy

## Unauthenticated Danswer API Confused Deputy Proxy in @eeacms/volto-chatbot ### Summary `@eeacms/volto-chatbot` expo

来源摘录 · GitHub Advisory

@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

CVE-2026-62264

### Impact When `@sylphx/pdf-reader-mcp` is run as an HTTP server (`MCP_TRANSPORT=http`), it reads the `MCP_API_KEY` en

来源摘录 · GitHub Advisory

PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox

CVE-2026-61438

### Summary JobWorkflowExecutor._exec_inline_python() is designed to safely execute inline Python expressions from YAML

来源摘录 · GitHub Advisory

Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

CVE-2026-62160

### Summary Daptin's `LanguageMiddleware` (registered as a global gin middleware) calls `golang.org/x/text/language.Par

来源摘录 · GitHub Advisory

Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a `DOCTYPE` with an external DTD ...

CVE-2026-93570

Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a craf

来源摘录 · NVD / GitHub Advisory

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticat...

CVE-2026-84294

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 20

来源摘录 · NVD / GitHub Advisory

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor...

CVE-2026-113387

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secre

来源摘录 · NVD / GitHub Advisory

systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

CVE-2026-116576

### Summary On Windows, `systeminformation@5.33.15` builds a PowerShell command using the value passed to `services()`.

来源摘录 · GitHub Advisory

FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GI...

CVE-2026-118753

FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attac

来源摘录 · NVD / GitHub Advisory

FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attacker...

CVE-2026-118752

FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIF

来源摘录 · NVD / GitHub Advisory

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

CVE-2026-116581

### Summary `fromJSON` and `fromCrossJSON` used two node fields without checking them. - An array node's element list

历史摘要 · 未重新核验 · GitHub Advisory

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

CVE-2026-116584

### Summary `fromJSON` and `fromCrossJSON` did not check that an array node's element list is an array. A small crafted

历史摘要 · 未重新核验 · GitHub Advisory

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

CVE-2026-116580

### Summary When `fromJSON` rebuilt an async iterator, it called `on()` on the iterator's source without checking that

历史摘要 · 未重新核验 · GitHub Advisory

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native...

CVE-2026-118664

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in ind

来源摘录 · NVD / GitHub Advisory

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious `...

CVE-2026-13451

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources

来源摘录 · NVD / GitHub Advisory