Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

CVE-2026-44457

### Summary Cache Middleware does not skip caching for responses that declare per-user variance via `Vary: Authorizatio

历史摘要 · 未重新核验 · GitHub Advisory

Mistune Heading ID Attribute has Injection XSS

CVE-2026-44897

## Summary `HTMLRenderer.heading()` builds the opening `` tag by string-concatenating the `id` attribute value directly

历史摘要 · 未重新核验 · GitHub Advisory

SharpCompress has directory traversal via directory entries in WriteToDirectory (zip slip variant)

CVE-2026-44788

### Summary A path traversal vulnerability in `IArchive.WriteToDirectory()` allows a malicious archive to create direct

历史摘要 · 未重新核验 · GitHub Advisory

Mistune has XSS via unescaped figclass/figwidth in Figure directive

CVE-2026-44896

In `src/mistune/directives/image.py`, the `render_figure()` function concatenates `figclass` and `figwidth` options dire

历史摘要 · 未重新核验 · GitHub Advisory

Mistune Math Plugin has an XSS Escape Bypass

CVE-2026-44708

## Summary The mistune math plugin renders inline math (`$...$`) and block math (`$$...$$`) by concatenating the raw use

历史摘要 · 未重新核验 · GitHub Advisory

view_component: System Test Entry Point Path Check Allows Sibling Directory Escape

CVE-2026-44837

### Summary The system test entrypoint canonicalizes a user-controlled file path with `File.realpath`, then checks whet

历史摘要 · 未重新核验 · GitHub Advisory

view_component: Preview Route Can Dispatch Inherited Helper Methods

CVE-2026-44836

### Summary The preview route derives an example name from the URL and calls it with `public_send`. The code does not v

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT has an open redirect vulnerability

CVE-2026-44833

Open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Refer

历史摘要 · 未重新核验 · GitHub Advisory

eml_parser has recursion DoS via nested message/rfc822 attachments

CVE-2026-44844

### Summary `EmlParser.get_raw_body_text()` recurses unconditionally for every nested `message/rfc822` attachment witho

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)

CVE-2026-44324

### Summary free5GC's UDR `nudr-dr` `DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subs

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)

CVE-2026-44323

### Summary free5GC's UDR `nudr-dr` `DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subs

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions

CVE-2026-44318

### Summary free5GC's BSF `PUT /nbsf-management/v1/subscriptions/{subId}` handler has an unsynchronized write on the glo

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference

CVE-2026-44317

### Summary free5GC's PCF `POST /npcf-policyauthorization/v1/app-sessions` handler panics on a single authenticated requ

历史摘要 · 未重新核验 · GitHub Advisory

gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits

CVE-2026-44309

## Summary `gitsign verify` and `gitsign verify-tag` re-encode commit/tag objects through go-git's `EncodeWithoutSignat

历史摘要 · 未重新核验 · GitHub Advisory

in-toto-golang and in-toto-python have inconsistent negation behavior

### Impact _What kind of vulnerability is it? Who is impacted?_ in-toto-golang and in-toto-python both support glob pat

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)

CVE-2026-44831

### Impact Users with component view access could be impacted by an unescaped `notes` column. ### Patches This was pat

历史摘要 · 未重新核验 · GitHub Advisory

Kimai has an arbitrary file read in its invoice PDF renderer (admin)

CVE-2026-44298

## Summary Users with the role `System-Admin` (`ROLE_SYSTE_ADMIN`) and the permission `upload_invoice_template` can upl

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order

CVE-2026-44568

## Vulnerability Details **CWE-79**: Cross-site Scripting (XSS) The `AccountPending.svelte` component renders the admi

历史摘要 · 未重新核验 · GitHub Advisory

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin...

CVE-2026-29201

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary f

历史摘要 · 未重新核验 · GitHub Advisory

eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields

CVE-2026-44214

### Summary `eventsource-encoder` does not sanitize the `event` or `id` fields of an `EventSourceMessage` before serial

历史摘要 · 未重新核验 · GitHub Advisory