Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

### Summary Oh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit

历史摘要 · 未重新核验 · GitHub Advisory

Shescape: Home-directory disclosure in assignment context on Unix with Dash

### Impact This impacts users of Shescape on Unix systems that explicitly configure `shell` to Dash, or `true` when the

历史摘要 · 未重新核验 · GitHub Advisory

Shescape: Path disclosure on Unix with Zsh

### Impact This impacts users of Shescape on Unix systems that explicitly configure `shell` to Zsh, or `true` when the

历史摘要 · 未重新核验 · GitHub Advisory

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

### Summary An authorization bypass vulnerability exists in the file sharing mechanism of `Openlist`. Due to a flawed, n

历史摘要 · 未重新核验 · GitHub Advisory

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

### Summary An authorization bypass and information disclosure vulnerability exists in the search API of `Openlist`. Due

历史摘要 · 未重新核验 · GitHub Advisory

swift-nio-http2: Missing CR/LF/NUL validation in header values

CVE-2026-64785

## Summary SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

## Summary Cloudreve exposes two admin node test endpoints under the `Admin.Read` OAuth scope. These endpoints accept a

历史摘要 · 未重新核验 · GitHub Advisory

Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

## Summary When an application configures hubuum_client with ClientBuilder::with_transport, several client operations s

历史摘要 · 未重新核验 · GitHub Advisory

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

## Impact The built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the init

历史摘要 · 未重新核验 · GitHub Advisory

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources

## Summary Kite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

# Budibase: SSRF via bare fetch() in uploadUrl during AI table generation ## Summary The `uploadUrl()` function in `pa

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Account Enumeration via Login Lockout Response Differential

## Summary The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticat

历史摘要 · 未重新核验 · GitHub Advisory

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown...

CVE-2026-57530

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milk

历史摘要 · 未重新核验 · GitHub Advisory

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin...

CVE-2026-57531

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allo

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

## Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and re

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored

CVE-2026-62323

## Summary Cloudreve WOPI access tokens are generated as `.`, but the WOPI middleware validates only the session id pre

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

## Summary The `/api/users/metadata` and `/api/users/metadata/:id` endpoints in `@budibase/server` return full global u

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

## Summary The `GET /api/global/groups` endpoint on the worker service has no role-based authorization middleware. Any

历史摘要 · 未重新核验 · GitHub Advisory

OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

CVE-2026-62280

### Description The OAuth2/OIDC consent page rendered for `display=wap` authorize requests reflected several request-der

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Arena task endpoints can bypass underlying model access controls

CVE-2026-59225

## Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying

历史摘要 · 未重新核验 · GitHub Advisory