SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch

SurrealDB fetches the JWKS document for a JWT or record access method using a bare `reqwest` client that follows HTTP re

历史摘要 · 未重新核验 · GitHub Advisory

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

### Summary `NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_n

历史摘要 · 未重新核验 · GitHub Advisory

Cloudflare Quiche: Use-after-free in connection ID iterator FFI functions

CVE-2026-11941

### Impact Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functio

历史摘要 · 未重新核验 · GitHub Advisory

Zeep: Server-Side Request Forgery (SSRF)

## Summary When parsing a WSDL or XSD document, python-zeep follows transitive references — xsd:import, xsd:include, ws

历史摘要 · 未重新核验 · GitHub Advisory

Anki: User scripts in iframes have access to the internal Anki API

## Summary Anki's webview-based pages communicate with the Rust backend using an internal localhost API. Anki implement

历史摘要 · 未重新核验 · GitHub Advisory

ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer

## Summary ChatterBot's `UbuntuCorpusTrainer.extract()` uses a predictable, home-rooted output directory (`~/ubuntu_dat

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data

### Summary `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups

### Summary `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions

## Summary `network-ai`'s `ApprovalInbox` (`lib/approval-inbox.ts`) is a shipped, exported, documented feature — *"a we

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

### Summary `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment c

历史摘要 · 未重新核验 · GitHub Advisory

MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested

PathFilter's deny-list glob patterns are anchored, so `.git`, `.obsidian`, and `node_modules` were only blocked at the v

历史摘要 · 未重新核验 · GitHub Advisory

symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses

CVE-2026-55877

### Description The `ux_icon()` Twig function is marked `is_safe=['html']`, so Twig never escapes its output. `Icon::to

历史摘要 · 未重新核验 · GitHub Advisory

OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types

CVE-2026-55776

On OpenBao 2.5.4 and 2.5.2(and likely earlier versions also), an authenticated caller with write access to `transit/keys

历史摘要 · 未重新核验 · GitHub Advisory

OpenBao: LDAPi ldaputil (wrong escape func)

CVE-2026-55770

## 1. Description ### Component `sdk/helper/ldaputil/client.go` — the shared LDAP utility library used by both the LDA

历史摘要 · 未重新核验 · GitHub Advisory

Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code...

CVE-2026-50519

Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized at

历史摘要 · 未重新核验 · GitHub Advisory

Improper neutralization of special elements used in a command ('command injection') in Microsoft...

CVE-2026-42895

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unaut

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request...

CVE-2026-12726

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller sto

历史摘要 · 未重新核验 · GitHub Advisory

A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance...

CVE-2026-27878

A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive

历史摘要 · 未重新核验 · GitHub Advisory

The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization...

CVE-2026-12238

The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up t

历史摘要 · 未重新核验 · GitHub Advisory

Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure

CVE-2026-55650

## Summary A Stored Cross-Site Scripting (XSS) issue previously existed in the Text Widget in Board of Outerbase Studio

历史摘要 · 未重新核验 · GitHub Advisory