FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

## Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affecte

历史摘要 · 未重新核验 · GitHub Advisory

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

CVE-2026-114437

### Summary `ClientIPFromXFF` skips any `X-Forwarded-For` entry in a configured trusted CIDR but never verifies that th

历史摘要 · 未重新核验 · GitHub Advisory

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

### Summary ODF style values are interpolated into `style="..."` attributes without HTML-escaping in odf-kit's ODS to-H

历史摘要 · 未重新核验 · GitHub Advisory

Tokio: Race condition in `tokio::time::Interval`

CVE-2026-115567

### Summary On the multi-threaded runtime, there is a race condition between `Interval::poll_tick` and the runtime's ti

历史摘要 · 未重新核验 · GitHub Advisory

Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

### Impact Three issues allowed actions protected by the `#[Authorize]` attribute to run against records the current us

历史摘要 · 未重新核验 · GitHub Advisory

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

## Impact In Echo v5, `ExtractIPFromRealIPHeader` checked whether the address supplied in `X-Real-IP` belonged to a tru

历史摘要 · 未重新核验 · GitHub Advisory

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

## Impact Echo v5's BodyDump middleware captured a bounded prefix, drained the remaining request body while ignoring re

历史摘要 · 未重新核验 · GitHub Advisory

Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

CVE-2026-115774

## Summary An infinite-loop vulnerability (CWE-835) in the Twisted IMAP4 server lets an authenticated client freeze the

历史摘要 · 未重新核验 · GitHub Advisory

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

CVE-2026-115877

## Summary An incomplete header-value validation (CWE-444) in the Twisted HTTP server lets a bare carriage return or li

历史摘要 · 未重新核验 · GitHub Advisory

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

CVE-2026-114050

## Summary Multimodal content parts (`image_url`, `video_url`, `input_audio`, ...) accept a user-supplied `uuid` field

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

CVE-2026-62204

## Summary `installBazaarPlugin` (and the equivalent endpoints for widgets/icons/templates/themes) accept `packageName`

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

CVE-2026-73630

### Summary `/api/filetree/authFilePublishAccess` is registered with `CheckAuth` only and is reachable anonymously. It

历史摘要 · 未重新核验 · GitHub Advisory

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to...

CVE-2026-106072

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when

历史摘要 · 未重新核验 · GitHub Advisory

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, ...

CVE-2026-106074

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, an

历史摘要 · 未重新核验 · GitHub Advisory

Server-side request forgery in the model download path in Amazon Web Services Multi Model Server...

CVE-2026-115813

Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier migh

历史摘要 · 未重新核验 · GitHub Advisory

Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle...

CVE-2026-115810

Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows aut

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen()...

CVE-2026-115485

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data wi

历史摘要 · 未重新核验 · GitHub Advisory

The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete...

CVE-2026-110491

The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operatio

历史摘要 · 未重新核验 · GitHub Advisory

The ONVIF device service on the E3 responds to certain informational requests without requiring...

CVE-2026-111100

The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability exists in the the time zone parameter and does not properly validate user input,...

CVE-2026-105265

A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an auth

历史摘要 · 未重新核验 · GitHub Advisory