Craft CMS: Sensitive File Disclosure / Server-Side File Read

CVE-2026-55792

The `dataUrl()` Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the

历史摘要 · 未重新核验 · GitHub Advisory

Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint

CVE-2026-54724

### Summary An open redirect vulnerability in the account confirmation endpoint allows an unauthenticated attacker to c

历史摘要 · 未重新核验 · GitHub Advisory

Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing

CVE-2026-55438

### Summary Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a worksp

历史摘要 · 未重新核验 · GitHub Advisory

Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component

CVE-2026-55437

### Summary The `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted t

历史摘要 · 未重新核验 · GitHub Advisory

Suspended Coder users retain access to AI Bridge LLM proxy endpoints

CVE-2026-55435

### Summary AI Bridge proxy endpoints authenticate via `Server.IsAuthorized` in `coderd/aibridgedserver`, which validat

历史摘要 · 未重新核验 · GitHub Advisory

Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints

CVE-2026-55434

### Summary AI Bridge provider handlers read request bodies with `io.ReadAll` without a maximum size so an authenticate

历史摘要 · 未重新核验 · GitHub Advisory

Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

CVE-2026-55433

### Summary The devcontainer recreate endpoint relied on route middleware that checked only `ActionRead` on the workspa

历史摘要 · 未重新核验 · GitHub Advisory

Coder's sub-agent app registration bypasses template port-sharing policy enforcement

CVE-2026-55432

### Summary The `CreateSubAgent` RPC did not validate a requested app sharing level against the template's `MaxPortShar

历史摘要 · 未重新核验 · GitHub Advisory

Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service

CVE-2026-55078

### Summary `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-ent

历史摘要 · 未重新核验 · GitHub Advisory

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

CVE-2026-55430

### Summary The workspace app proxy resolves the target app from `httpapi.RequestHost()` which prefers the `X-Forwarded

历史摘要 · 未重新核验 · GitHub Advisory

Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service

CVE-2026-55079

### Summary `NewDataBuilder` in `provisionersdk/proto/dataupload.go` allocated a byte slice using the client-supplied `

历史摘要 · 未重新核验 · GitHub Advisory

CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation

CVE-2026-53935

### Impact Users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMat

历史摘要 · 未重新核验 · GitHub Advisory

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check

CVE-2026-53624

### Summary The `helmet` middleware in gofiber/fiber never sets the `Strict-Transport-Security` (HSTS) response header,

历史摘要 · 未重新核验 · GitHub Advisory

Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

CVE-2026-54637

## Summary The Dragonfly **scheduler**'s v1 gRPC service contains an unauthenticated Server-Side Request Forgery (SSRF)

历史摘要 · 未重新核验 · GitHub Advisory

Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

### Summary A user with Control Panel access but without permission to view a target private asset can call `assets/pre

历史摘要 · 未重新核验 · GitHub Advisory

printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

CVE-2026-35366

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences.

历史摘要 · 未重新核验 · GitHub Advisory

mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)

CVE-2026-35365

When moving directories across filesystems, uutils `mv` dereferences symlinks inside the tree, copying their targets as

历史摘要 · 未重新核验 · GitHub Advisory

cp: -R reads device nodes as streams, destroying device semantics

CVE-2026-35358

The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device

历史摘要 · 未重新核验 · GitHub Advisory

rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents, bypassing dot protection

CVE-2026-35363

`rm -rf .` is correctly refused, but `clean_trailing_slashes` normalizes `.///` to `./` while `path_is_current_or_parent

历史摘要 · 未重新核验 · GitHub Advisory

comm: FIFO/pipe inputs are drained before comparison (data loss / hang)

CVE-2026-35347

The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison

历史摘要 · 未重新核验 · GitHub Advisory