summary: Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence in the slidesDir request parameter. Attackers can exploit this to write slide_*.png and slides.json files to any writable directory and subsequently delete matching files at the specified location through repeat extraction.


default_status: affected

product: summarize

vendor: steipete

status: affected

version_type: semver

status: unaffected

version_type: git

ecosystem: software/application

metric_type: Secondary

severity: medium

part: a

quality: metadata-backed

recipe_kind: composed

status: Analyzed

summary: Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.

title: Steipete Summarize security vulnerability


severity: low

summary: Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.


archetype: ssrf

severity: high

summary: Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with attacker-controlled content.


summary: Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the replacement with default process umask permissions instead of preserving the original file permissions, exposing the config file containing API keys and provider credentials to other local users on shared Unix-like systems.


product: Full Page Cache Warmer for Magento 2

vendor: Mirasvit

business_risk: No additional source-verified CVE-specific business impact was established.

uncertainty: The returned authoritative sources establish the affected range and fixed version but do not provide a complete, safe verification recipe or a vendor-documented compensating-control configuration.

uncertainty: The supplied record identifies the affected range as versions before 1.11.12; NVD corroborates this range, while the vendor changelog confirms the fix in version 1.11.12.

uncertainty: No authoritative source reviewed here establishes whether a particular deployment has the vulnerable feature enabled or whether an intermediary control blocks the relevant request path.

known_ransomware_campaign_use: Unknown

product: Mirasvit Full Page Cache Warmer

required_action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

vendor_project: Mirasvit

vulnerability_name: Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability

severity: critical

vendor: mirasvit

summary: Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.


product: guardian

vendor: hashgraph

vendor: hedera

summary: Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows unauthenticated attackers to retrieve sensitive user information. Attackers can access the endpoint without providing authentication credentials to obtain usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users in the system.

title: Hedera Guardian security vulnerability


default_status: unaffected

product: Apache ECharts

vendor: Apache Software Foundation

product: echarts

vendor: apache

summary: A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic. This issue affects Apache ECharts: from before 6.1.0. In versions prior to 6.1.0, if both Lines series and tooltip are used, and no user-specified tooltip.formatter is provided, and series.data[i].name is specified, raw HTML string series.data[i].name can be rendered through innerHTML sink into tooltip content. Although tooltip is allowed to accept user-provided raw HTML via a custom tooltip.formatter, the built-in tooltip formatters conventionally perform HTML escaping automatically. This case breaks that convention and may unexpectedly lead to script execution when tooltips are displayed. Users are recommended to upgrade to version 6.1.0 if using the Lines series in this way, which fixes the issue.


default_status: unknown

product: FreeBSD

vendor: FreeBSD

version_type: release

ecosystem: operating-system

part: o

product: freebsd

vendor: freebsd

status: Modified

summary: The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validating its length. If the supplied list exceeds the capacity of that buffer, a stack buffer overflow occurs. Because the bounds check on the supplementary groups list occurs after the kernel stack buffer has already been written, an unprivileged local user may trigger the overflow without holding any special privilege. Successful exploitation may allow an attacker to execute arbitrary code in the context of the kernel, allowing an unprivileged local user to gain elevated privileges on the affected system.


summary: A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the thread remains blocked. In this situation, the kernel must remove the blocked thread from the per-object wait queue prior to freeing the object. In the case of some file descriptor types, the kernel failed to unlink blocked threads from the object before freeing it. When the blocked thread is subsequently woken, it accesses memory that has already been freed resulting in a use-after-free vulnerability. The use-after-free vulnerability may be triggered by an unprivileged local user and can be exploited to obtain superuser privileges.


summary: When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings. The fusefs kernel module calls strlen() on this daemon-supplied buffer without first verifying that the entire list is NUL-terminated. If a malicious daemon sends a non-NUL-terminated list, the fusefs kernel module may read beyond the end of one heap-allocated buffer and potentially write beyond the end of a second buffer. A malicious daemon could disclose up to 253 bytes of kernel heap memory, or it could inject up to 250 attacker-controlled bytes into unallocated kernel heap space.

title: Freebsd security vulnerability


summary: ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to debug a process may trigger arbitrary code execution in the kernel, even if the target process has no special privileges. The missing validation allows an unprivileged local user to escalate privileges, potentially gaining full control of the affected system.


summary: In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of being rejected. In certain scenarios, an application that had previously restricted a subset of network operations could ask for a new limit that extended the permissions of the process.

title: Freebsd security vulnerability


summary: When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network. This is implemented using a shell script, and the code which handled network names was not careful to prevent expansion by the shell. As a result, a suitably crafted network name can be used to execute commands via a subshell. The problem can be exploited to execute code as root on the system running bsdinstall or bsdconfig. The attacker would need to create an access point with a specially crafted name and be within range of a Wi-Fi scan. Note that bsdinstall and bsdconfig are vulnerable as soon as the user prompts them to scan for nearby networks; they do not need to actually select the malicious network.

title: Freebsd security vulnerability


summary: When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not check the result before delivering the signal. The signal was sent even when the permission check failed. The system call returned the resulting error to the caller, but by then the signal had already been delivered. The missing check allows an unprivileged local user who knows or can guess a target's process and thread IDs to send any signal to a process they would not normally be permitted to signal, including processes owned by other users or by root. The same check enforces jail boundaries, so a jailed process can signal processes on the host or in other jails. Thread IDs are allocated globally and sequentially, and so can be discovered by brute force with no visibility into the target. An attacker can stop or terminate arbitrary processes, including critical system daemons, resulting in a Denial of Service (DoS).

title: Freebsd security vulnerability


archetype: generic

summary: The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile(2), which can reference file-backed memory directly through non-anonymous M_EXTPG pages or EXT_SFBUF mbufs. When the sender transmits such data over a loopback connection without enabling KTLS on the transmit side, the file-backed mbufs reach the receiver's decryption path unchanged. Decrypting a record in place then overwrites the backing file's page cache instead of a private copy of the data. An unprivileged local user who can read a file can overwrite its contents with data of their choosing by sending the file over a loopback connection on which they have enabled KTLS receive. The write modifies the page cache directly, so it bypasses file flags such as schg and is written back to disk. By overwriting a setuid binary or other trusted file, a local user can escalate privileges, potentially gaining full control of the affected system.


author: Codex

description: CVE-2026-45258 is dsp_mmap_single offset-plus-length mapping check. GitHub lists no advisory for this CVE. Do not invent a GHSA ID or copy leftover version text.

maturity: development

model: GPT 5.5 Extra High reasoning

title: CVE-2026-45258: dsp_mmap_single, No Named Floor

recipe_kind: markdown-draft

summary: dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narrowed from 64 to 32 bits when converted to a buffer address, yielding a mapping that extended past the audio buffer into unrelated kernel memory. The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, which can be used to escalate privileges, potentially gaining full control of the affected system. At a minimum, an attacker can crash the kernel, resulting in a Denial of Service (DoS).


summary: sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a capability mode check restricting signal delivery to the calling process's own PID. A process in capability mode can use sigqueue(2) to send signals to any process it could signal following standard Unix permissions, bypassing the Capsicum sandbox restriction. A compromised sandboxed process could interfere with other processes, for example by sending SIGKILL or SIGSTOP. This could be any process running as the same user, or any process, for a superuser sandboxed process.

title: Freebsd security vulnerability


product: pimcore

vendor: pimcore

description: CVE-2026-45260 is Pimcore leftover. GHAD first_patched is 12.3.7 / 2026.1.3 / 11.5.17. NVD/vendor prose omits 2026.1.3.

title: CVE-2026-45260: Pimcore leftover dump, floors 12.3.7 / 2026.1.3 / 11.5.17

status: Deferred

summary: Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and models/Asset/WebDAV/Tree.php performs asset mutation and deletion through models/Asset.php before checking a current Pimcore user or the rename, delete, create, or publish permissions, allowing unauthorized asset deletion, moves, or overwrites. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.


product: gitbutler

vendor: gitbutlerapp

summary: GitButler is a modern Git-based version control interface for AI-powered workflows. Prior to 0.19.7, a emote code execution vulnerability exists in the Tauri-based GitButler desktop application. An attacker can inject a malicious link in a pull request body, which if clicked by the user allows for arbitrary script execution in the Tauri webview. Users that have not enabled forge integration are not at risk. This vulnerability is fixed in 0.19.7.


product: security-advisories

vendor: nextcloud

summary: Nextcloud is an open source content collaboration platform. From versions 17.0.0 to before 17.0.15, 18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4, a user with READ and CREATE permission, but no UPDATE permission for a team folder can rename files in the team folder. This issue has been patched in versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4.


summary: Nextcloud is an open source content collaboration platform. Prior to version 5.2.6, a missing permissions check allowed users to request reading form submissions of other users. This issue has been patched in version 5.2.6.


summary: CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html_purify` validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (`Home::index()` → `app/Views/templates/default/pages.php`) emits `$pageInfo->content` without `esc()`, yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at `/` and reach every visitor of the site. Version 0.31.9.0 patches the issue.


product: picotls

status: Received

summary: Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS#8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7, the validator recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. If an application loads an attacker-supplied private-key file through ptls_minicrypto_load_private_key(), or otherwise calls the public ASN.1 validation API on untrusted DER, a crafted deeply nested ASN.1 structure can exhaust the process stack and crash the application. Note that the libcrypto (OpenSSL) backend does not use the ASN.1 validation helper of picotls, and therefore is immune to this vulnerability. The vulnerability has been addressed in commit c14231d801407640bc42c2dcf92783409ea6a7c7.


product: talebook

vendor: PoxenStudio

ecosystem: python/pypi

summary: MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIAL_AUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in webserver/loader.py concatenates those names into the generated Python source file auto.py without escaping them. An administrator can submit a crafted SOCIAL_AUTH key name that closes the settings dictionary and injects arbitrary Python statements. The application later executes those statements because SettingsLoader.loadfile imports auto.py as a module, and setting autoreload to true invokes restart_async so a process supervisor restarts the service and triggers the import. Successful exploitation executes commands with the privileges of the application service account and can disclose data, modify files, establish persistence, or disrupt the service. Related authorization and registration vulnerabilities can reduce the effective privilege requirement in a chained attack, but the standalone vulnerability requires administrator access. This issue is fixed in version 3.42.0.


summary: MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.admin_user property, unlike the corresponding GET handler. Any authenticated regular user can therefore overwrite server configuration values including SMTP credentials, OAuth client secrets, storage paths, security feature flags, and autoreload settings. The process_auth_header function in webserver/handlers/base.py also fails to verify the matched account's active flag, allowing a registered but unactivated account to authenticate and reach the vulnerable handler. Exploitation can disclose secrets through configuration access paths, sabotage application behavior, force service restarts, and supply the settings needed for related code-injection attacks. This issue is fixed in version 3.42.0.


summary: MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/sign_up in webserver/handlers/user.py does not enforce the ALLOW_REGISTER configuration flag, even though the frontend hides registration controls when the flag is false. An unauthenticated remote attacker can call the endpoint directly and create a valid account on an instance whose administrator disabled public registration. The process_auth_header function in webserver/handlers/base.py also does not verify the account's active flag, so the newly created and unactivated account can authenticate immediately and access user-level API functionality. The bypass defeats the intended account-creation policy and can supply the low-privilege account required by related authorization vulnerabilities. This issue is fixed in version 3.42.0.


product: approval

summary: Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in version 2.7.2.


metric_type: Primary

summary: Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.


summary: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is upgraded to 32.0.4, 31.0.14. It is recommended that the Nextcloud Enterprise Server is upgraded to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, 28.0.14.15


summary: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL an attacker could possibly send a request to gain full access to their calendar. Therefore, the attacker must be an authenticated user. This is because of improper authorization controls in the backend of the calendar. If the attacker had access to the calendar, they would be able to view and modify it. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17, 27.1.11.26, 26.0.13.26, 25.0.13.29, 24.0.12.34, 23.0.12.35, 22.2.10.39, or 21.0.9.23


summary: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, circumventing password protection or download restrictions. It is applicable to any file that is shared directly, as the attacker only needs to know a documentId they own, apart of the mentioned share token. For shared folders the attacker has to know or guess a documentId of a file that is included inside the folder, making it much harder to exploit. The attacker can only extract an attachments, but not the file shared file or folder itself. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17 or 27.1.11.5


summary: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Additionally, lock tokens were disclosed to unauthorized callers in error responses, allowing attackers to remove token-based locks placed by other users' client applications. It is recommended that the Nextcloud Server is upgraded to 32.0.2 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 31.0.14.4 or 32.0.2 or 33.0.1


summary: Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0.


summary: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includes an external member (a person added via email address who does not have a Nextcloud account), the system automatically creates a public link for that external member. This public link is not displayed in the share section of the folder, so the folder owner has no knowledge of its existence. It is sent via email to the external member. It grants the same permissions (read, write, delete, reshare, download) as the Team’s access. An attacker who receives or intercepts this link can access, modify, delete, reshare, and download all data in the shared folder without any further authentication. The folder owner cannot see or revoke the link through the normal sharing interface. This issue has been patched in versions 32.0.9 and 33.0.3.


product: calendar

summary: Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3.


vendor: open-telemetry

vendor: opentelemetry

summary: OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.


product: marten

vendor: JasperFx

summary: Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten's full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. This vulnerability is fixed in 8.36.1.


product: Protocol

vendor: CloudburstMC

summary: CloudburstMC Protocol is a protocol library for Minecraft Bedrock Edition. Prior to version 3.0.0.Beta12-20260420.182526-15, CloudburstMC Protocol is partially missing validation for FULL type authentication tokens (Cloudburst/Protocol). This vulnerability impacts publicly accessible software depending on the affected versions of Protocol, specifically the EncryptionUtils methods to validate auth payloads for FULL type tokens. This issue has been patched in version 3.0.0.Beta12-20260420.182526-15.


product: Network

summary: Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR3-20260417.085727-30` impacts publicly accessible software depending on the affected versions of Network and allows an attacker to exploit a vulnerability in Network to stall the netty event loop, rendering it inoperable. All consumers of the library should upgrade to at least version `1.0.0.CR3-20260417.085727-30`. There are no known workarounds beyond updating the library.


summary: Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR3-20260418.124334-32` impacts publicly accessible software depending on the affected versions of Network and allows an attacker to exploit a bug in Network to close the parent netty channel, rendering it inoperable. All consumers of the library should upgrade to at least version `1.0.0.CR3-20260418.124334-32`. There are no known workarounds beyond updating the library.


product: opentelemetry-java

product: opentelemetry-api

product: Red Hat Data Grid 8.6.2

vendor: Red Hat

version: trace-propagators

version_type: rpm

product: Red Hat Migration Toolkit for Applications 8.2

product: Red Hat Offline Knowledge Portal 1.2.9

product: Red Hat OpenShift AI 3.4

product: Red Hat OpenShift Dev Spaces 3.29

product: Exploit Intelligence

product: Migration Toolkit for Containers

product: OpenShift Serverless

product: Red Hat JBoss Enterprise Application Platform Expansion Pack

ecosystem: java/maven

part: redhat

status: Awaiting Analysis

summary: opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.

title: Open-Telemetry Opentelemetry-Java security vulnerability


product: WordPress-Coding-Standards

vendor: WordPress

ecosystem: php/wordpress

summary: WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.


product: freescout

vendor: freescout-help-desk

summary: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct responses depending on whether the submitted email address belongs to an existing user account, allowing unauthenticated attackers to enumerate valid helpdesk agent email addresses. This vulnerability is fixed in 1.8.219.


summary: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint `GET /thread/read/{conversation_id}/{thread_id}` allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state (`opened_at` timestamp) without any authentication. Version 1.8.219 patches the issue.


product: openreplay

vendor: openreplay

summary: OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay's Python API exposes several app_apikey routes that trust a caller-provided projectKey after validating only that the API key itself is valid and that the target projectKey exists. The authorization flow does not verify that the authenticated API key and the requested project belong to the same tenant. Because the public tracker design exposes projectKey to browser-side code, an attacker who owns any valid API key for their own tenant can target another tenant's project by reusing that public projectKey. The vulnerable routes allow the attacker to enumerate victim user sessions and then retrieve sensitive session event data across the tenant boundary. This vulnerability is fixed in 1.26.0.


summary: OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ (OSS api/auth/auth_project.py:14-38 and EE ee/api/auth/auth_project.py:14-46) only runs projects.is_authorized(project_id, tenant_id, user_id) + projects.get_project(tenant_id, project_id) when self.project_identifier == "projectId" (camelCase). For EE multi-tenant, feature-flag queries only filter on project_id, never tenant_id. Any authenticated user in tenant A can read/update/delete feature-flag rows belonging to tenant B by iterating the sequential integer project_id + feature_flag_id. OSS is single-tenant by design ({"errors":["tenants already registered"]} on second signup) so there's no cross-tenant impact This vulnerability is fixed in 1.26.0.


product: dozzle

vendor: amirraminfar

summary: Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that sends an HTTP POST to the supplied URL with attacker-controlled request headers, and returns the response status code AND up to 1MB of the response body to the caller, when the target replies non-2xx. This vulnerability is fixed in 10.5.2.


product: open-webui

vendor: open-webui

vendor: openwebui

summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, the profile_image_url field on the user profile update form accepted arbitrary data: URI values without MIME-type validation, resulting in a XSS vulnerability. This vulnerability is fixed in 0.8.0.


product: async-http-client

vendor: AsyncHttpClient

summary: The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.


product: parse-nested-form-data

vendor: milamer

summary: parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with __proto__, or contains .__proto__. mid-path, causes the parser to traverse onto Object.prototype and assign properties there, polluting the prototype chain of every plain object in the running process. This issue has been patched in version 1.0.1.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.5, through the HTML rendering view, scripts can be injected and executed. The frontend provides a function to visualize the HTML content of a current chat. The content is embedded in an iFrame with the allow-scripts allow-forms allow-same-origin sandbox directive. This means that the content is placed in a sandbox but with permission to execute scripts and access the parent’s data (e.g., local storage). As a result, only a few functions are restricted (e.g., displaying an alert box), but in effect, the sandbox attribute is largely nullified. This vulnerability is fixed in 0.6.5.


product: symfony

vendor: symfony

product: yaml

vendor: sensiolabs

summary: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.


summary: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.


product: pyload

vendor: pyload

summary: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeover. This vulnerability is fixed in 0.5.0b3.dev100.


product: speakr

vendor: murtaza-nasir

summary: Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.20-alpha, the is_safe_url() helper used to validate post-login redirect targets applied urljoin(request.host_url, target) before parsing, while the controller passed the raw target to redirect(). A scheme-relative input such as ////evil.com resolved to a same-host URL during validation but was emitted verbatim in the Location header, where the browser interpreted it as a network-path-relative redirect to an attacker-controlled host. This vulnerability is fixed in 0.8.20-alpha.


product: asyncssh

vendor: ronf

summary: AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py with the raw SSH username during pre-authentication server config reload, allowing a server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the intended directory when the SSH username contains /, \, or .. path traversal segments and authenticate with an attacker-selected key file. This issue is fixed in version 2.23.0.

title: Asyncssh Project Asyncssh security vulnerability


product: CodeWhale

vendor: Hmbown

summary: CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's resolved IP address against a restricted-IP blocklist (is_restricted_ip()) to prevent SSRF attacks against internal services (cloud metadata endpoints, localhost, private networks). However, the HTTP client (reqwest) is configured to automatically follow up to 5 redirects (reqwest::redirect::Policy::limited(5)) without re-validating the redirect target against the same SSRF protections. This vulnerability is fixed in 0.8.22.


summary: CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary code: test binaries, build.rs build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval. The attack is amplified by AGENTS.md (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start. This vulnerability is fixed in 0.8.23.


product: ragflow

vendor: infiniflow

summary: RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any normal user can register, create a Canvas workflow with a DuckDuckGo + LLM component chain, and trigger the SSTI.


product: Sandboxie

vendor: sandboxie-plus

ecosystem: windows/system

summary: Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.17.6, GuiServer::WndHookRegisterSlave in Sandboxie/core/svc/GuiServer.cpp stores attacker-supplied hthread and hproc fields from a GUI_WND_HOOK_REGISTER request without validating that the thread belongs to the sandboxed process or that the function pointer is in the caller address space, and GuiServer::WndHookNotifySlave then calls OpenThread(THREAD_SET_CONTEXT, FALSE, whk->hthread) and QueueUserAPC((PAPCFUNC)whk->hproc, hThread, (ULONG_PTR)req->threadid) as SYSTEM, allowing a sandboxed process to execute arbitrary code in an unsandboxed host process. This issue is fixed in version 1.17.6.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the channel webhook create/update flow accepts arbitrary profile_image_url values, including data:image/svg+xml;base64,... payloads. The profile image endpoint then decodes and serves this SVG as image/svg+xml without sanitization, allowing attacker-controlled script handlers (for example onload) to execute when the profile-image URL is opened in the browser. This vulnerability is fixed in 0.9.3.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint takes the file extension from the user-supplied filename and saves the file under CACHE_DIR/audio/transcriptions/.. The /cache/{path} route serves these files via FileResponse, which sets Content-Type from the on-disk extension and emits no Content-Disposition. A verified user with the default-on chat.stt permission can upload a polyglot WAV+HTML file named pwn.html and trick any other user into opening the resulting URL — the response comes back as text/html and any embedded <script> runs in the Open WebUI origin. This vulnerability is fixed in 0.9.3.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, an application-wide Cross-Site Request Forgery (CSRF) vulnerability was found Open-WebUl's image uploading functionality. An attacker can set an image URL to a malicious endpoint, allowing them to perform actions on behalf of a victim user. Any authenticated user can exploit this vulnerability, and any user who views the compromised image (e.g., a profile picture) will unknowingly send a GET request to the attacker-controlled URL. This can lead to cookie theft, denial of service (DoS), or other malicious actions. This vulnerability is fixed in 0.9.3.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, his advisory tracks a regression of the original Excel-preview XSS (CVE-2026-44549). The same root cause — XLSX.utils.sheet_to_html() output rendered via {@html excelHtml} without DOMPurify — was reintroduced sometime after v0.8.0 and is exploitable again This vulnerability is fixed in 0.9.3.


product: dataease

vendor: dataease

summary: DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as ${deptId} are processed by SqlparserUtils.transFilter(), whose final branch returns raw user input for non-in and non-between operators before SubstitutedSql.replace("${var}", value) splices it into dashboard SQL, allowing authenticated users who can view a dashboard to inject SQL against integrated datasources. This issue is fixed in version 2.10.23


product: arktype-adapter

product: eslint-plugin-router

product: eslint-plugin-start

product: history

product: react-router

product: react-router-devtools

product: react-router-ssr-query

product: react-start

product: react-start-client

product: react-start-rsc

product: react-start-server

ecosystem: javascript/npm

known_ransomware_campaign_use: Known

notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx ; https://nvd.nist.gov/vuln/detail/CVE-2026-45321

product: TanStack

vendor_project: TanStack

vulnerability_name: TanStack Unspecified Vulnerability

content_markdown:
On 2026-05-11, 84 malicious versions across 42 `@tanstack/*` npm
packages were published under a trusted TanStack identity. The advisory
describes a chain that crossed three build boundaries: unsafe
`pull_request_target` execution, GitHub Actions cache poisoning across fork and
base repository trust zones, and extraction of an npm trusted-publishing OIDC
token from the Actions runner process.

CISA added CVE-2026-45321 to the Known Exploited Vulnerabilities catalog on
**2026-05-27** (required action due **2026-06-10**) and currently records known
ransomware campaign use. Rechecked against GHSA-g7cv-rxg3-hmpx and the CISA KEV
JSON on 2026-08-21; the 42-package / 84-version table and first patched
releases are unchanged.

This is not a normal vulnerable dependency. Any developer workstation, CI
runner, build image, cache, or artifact mirror that installed one of the exact
malicious versions must be treated as potentially compromised because the
payload harvested cloud credentials, GitHub tokens, npm tokens, SSH private
keys, Kubernetes service-account tokens, Vault tokens, and other secrets
available to the install process.

## When to use it

Use this recipe when a repository, build image, CI workflow, package mirror, or
developer environment may have installed a malicious `@tanstack/*` package
version from the 2026-05-11 compromise. It is for exact-version compromise
response, not generic dependency hygiene.

It is most valuable when the remediation must coordinate code changes,
lockfile regeneration, cache and mirror quarantine, credential rotation, and
GitHub Actions trust-boundary hardening in one reviewable packet.

## Inputs

- Package manifests, lockfiles, SBOMs, generated dependency reports, vendored
  modules, Docker layers, package-manager stores, and registry/proxy mirror
  metadata that may reference `@tanstack/*`.
- CI and release workflow files, especially `pull_request_target`, cache
  restore/save behavior, npm trusted publishing, and jobs with `id-token:
  write`.
- Build logs and runner/image inventory showing whether affected versions were
  installed on or after 2026-05-11 19:20 UTC, without exposing secrets.
- Internal cache, mirror, and artifact-retention ownership for purging exact
  malicious package coordinates.
- Credential-rotation ownership for GitHub, npm, cloud, SSH, Kubernetes,
  Vault, package-registry, and deployment credentials reachable by install
  scripts.

## Affected versions

The affected set is exact-version based, not a broad semver range. Each package
had two malicious versions, followed by a clean patched version.

| Package | Malicious versions | First patched version |
| --- | --- | --- |
| `@tanstack/arktype-adapter` | `1.166.12`, `1.166.15` | `1.166.16` |
| `@tanstack/eslint-plugin-router` | `1.161.9`, `1.161.12` | `1.161.13` |
| `@tanstack/eslint-plugin-start` | `0.0.4`, `0.0.7` | `0.0.8` |
| `@tanstack/history` | `1.161.9`, `1.161.12` | `1.161.13` |
| `@tanstack/nitro-v2-vite-plugin` | `1.154.12`, `1.154.15` | `1.154.16` |
| `@tanstack/react-router` | `1.169.5`, `1.169.8` | `1.169.9` |
| `@tanstack/react-router-devtools` | `1.166.16`, `1.166.19` | `1.166.20` |
| `@tanstack/react-router-ssr-query` | `1.166.15`, `1.166.18` | `1.166.19` |
| `@tanstack/react-start` | `1.167.68`, `1.167.71` | `1.167.72` |
| `@tanstack/react-start-client` | `1.166.51`, `1.166.54` | `1.166.55` |
| `@tanstack/react-start-rsc` | `0.0.47`, `0.0.50` | `0.0.51` |
| `@tanstack/react-start-server` | `1.166.55`, `1.166.58` | `1.166.59` |
| `@tanstack/router-cli` | `1.166.46`, `1.166.49` | `1.166.50` |
| `@tanstack/router-core` | `1.169.5`, `1.169.8` | `1.169.9` |
| `@tanstack/router-devtools` | `1.166.16`, `1.166.19` | `1.166.20` |
| `@tanstack/router-devtools-core` | `1.167.6`, `1.167.9` | `1.167.10` |
| `@tanstack/router-generator` | `1.166.45`, `1.166.48` | `1.166.49` |
| `@tanstack/router-plugin` | `1.167.38`, `1.167.41` | `1.167.42` |
| `@tanstack/router-ssr-query-core` | `1.168.3`, `1.168.6` | `1.168.7` |
| `@tanstack/router-utils` | `1.161.11`, `1.161.14` | `1.161.15` |
| `@tanstack/router-vite-plugin` | `1.166.53`, `1.166.56` | `1.166.57` |
| `@tanstack/solid-router` | `1.169.5`, `1.169.8` | `1.169.9` |
| `@tanstack/solid-router-devtools` | `1.166.16`, `1.166.19` | `1.166.20` |
| `@tanstack/solid-router-ssr-query` | `1.166.15`, `1.166.18` | `1.166.19` |
| `@tanstack/solid-start` | `1.167.65`, `1.167.68` | `1.167.69` |
| `@tanstack/solid-start-client` | `1.166.50`, `1.166.53` | `1.166.54` |
| `@tanstack/solid-start-server` | `1.166.54`, `1.166.57` | `1.166.58` |
| `@tanstack/start-client-core` | `1.168.5`, `1.168.8` | `1.168.9` |
| `@tanstack/start-fn-stubs` | `1.161.9`, `1.161.12` | `1.161.13` |
| `@tanstack/start-plugin-core` | `1.169.23`, `1.169.26` | `1.169.27` |
| `@tanstack/start-server-core` | `1.167.33`, `1.167.36` | `1.167.37` |
| `@tanstack/start-static-server-functions` | `1.166.44`, `1.166.47` | `1.166.48` |
| `@tanstack/start-storage-context` | `1.166.38`, `1.166.41` | `1.166.42` |
| `@tanstack/valibot-adapter` | `1.166.12`, `1.166.15` | `1.166.16` |
| `@tanstack/virtual-file-routes` | `1.161.10`, `1.161.13` | `1.161.14` |
| `@tanstack/vue-router` | `1.169.5`, `1.169.8` | `1.169.9` |
| `@tanstack/vue-router-devtools` | `1.166.16`, `1.166.19` | `1.166.20` |
| `@tanstack/vue-router-ssr-query` | `1.166.15`, `1.166.18` | `1.166.19` |
| `@tanstack/vue-start` | `1.167.61`, `1.167.64` | `1.167.65` |
| `@tanstack/vue-start-client` | `1.166.46`, `1.166.49` | `1.166.50` |
| `@tanstack/vue-start-server` | `1.166.50`, `1.166.53` | `1.166.54` |
| `@tanstack/zod-adapter` | `1.166.12`, `1.166.15` | `1.166.16` |

## Indicator-of-exposure

- A manifest, lockfile, SBOM, build log, package cache, mirror, proxy registry,
  Docker layer, or generated dependency report includes one of the exact
  malicious `@tanstack/*` versions above.
- CI or a developer machine ran `npm install`, `npm ci`, `pnpm install`, or
  `yarn install` for an affected dependency during or after the malicious
  publish window on 2026-05-11.
- A package tarball contains the malicious indicators documented by TanStack:
  `optionalDependencies["@tanstack/setup"]` pointing to
  `github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c`, a
  root-level `router_init.js`, or a helper named `tanstack_runner.js`.
- GitHub Actions workflows use `pull_request_target` and then check out or
  execute fork-controlled code in the base repository trust context.
- Release or publish workflows restore caches that can be written by untrusted
  PR workflows, especially when the release workflow has `id-token: write`,
  npm trusted publishing, package publishing tokens, cloud credentials, SSH
  keys, or deployment secrets.

Quick checks:

```bash
rg -n "@tanstack/|router_init\\.js|@tanstack/setup|79ac49eedf774dd4b0cfa308722bc463cfe5885c|pull_request_target|id-token: write|actions/cache|restore-keys" .
npm ls --all 2>/dev/null | rg "@tanstack/" || true
pnpm list --depth Infinity 2>/dev/null | rg "@tanstack/" || true
yarn list --pattern "@tanstack/" 2>/dev/null || true
```

Windows:

```powershell
rg -n '@tanstack/|router_init\.js|@tanstack/setup|79ac49eedf774dd4b0cfa308722bc463cfe5885c|pull_request_target|id-token: write|actions/cache|restore-keys' .
npm ls --all 2>$null | rg '@tanstack/'
pnpm list --depth Infinity 2>$null | rg '@tanstack/'
yarn list --pattern '@tanstack/'
```

To inspect a tarball without executing lifecycle scripts:

```bash
npm pack @tanstack/react-router@1.169.8 --ignore-scripts
tar -xzf tanstack-react-router-*.tgz
grep -A5 '"optionalDependencies"' package/package.json
test ! -f package/router_init.js
```

Run tarball inspection only in a disposable directory. Do not run package
install scripts for a suspected malicious version.

## Remediation strategy

- Remove every exact malicious version from manifests, lockfiles, vendored
  dependency folders, generated reports, Docker layers, package mirrors, and
  build caches. Upgrade to the first patched version or newer for each affected
  package.
- Recreate lockfiles from a clean dependency graph. Do not trust a lockfile
  generated on a runner or workstation that may have executed the malicious
  package.
- Delete `node_modules`, package-manager stores, CI workspaces, and build
  caches that may contain the affected tarballs. Pair the PR with the
  [cache-quarantine workflow]({{< relref "/security-remediation/artifact-cache-purge" >}})
  when the organization owns registry mirrors or pull-through caches.
- Treat affected install environments as compromised. Rotate tokens and keys
  reachable by the install process, including GitHub tokens, npm tokens, cloud
  credentials, SSH keys, Kubernetes service-account tokens, Vault tokens, and
  package-registry credentials.
- Audit GitHub Actions trust boundaries before re-enabling release automation:
  remove fork-controlled code execution from `pull_request_target`, isolate
  caches for untrusted PRs from release jobs, avoid broad `restore-keys`, and
  grant `id-token: write` only to the final publish job after the build inputs
  are fixed and verified.
- Add package-version and workflow-policy guard tests so malicious exact
  versions and unsafe Actions trust-boundary patterns do not re-enter.

## The prompt

~~~markdown
You are remediating CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx, the
KEV-listed TanStack npm supply-chain compromise where 84 malicious versions
across 42 `@tanstack/*` packages exfiltrated credentials during install.
Produce exactly one output:

- A reviewer-ready PR/change request that removes affected TanStack versions,
  regenerates clean lockfiles, purges repository-controlled caches and mirrors,
  adds regression guards, audits GitHub Actions publishing boundaries, and
  documents credential-rotation/operator actions, or
- `TRIAGE.md` if this repository has no controlled npm dependency graph,
  cache, image, CI workflow, or release pipeline exposure that can be safely
  remediated here.

## Rules

- Scope only CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx and directly related
  TanStack dependency, npm install, cache, mirror, and GitHub Actions publishing
  boundaries.
- Treat all tokens, SSH keys, cloud credentials, package-registry credentials,
  Kubernetes service-account tokens, Vault tokens, CI secrets, and developer
  workstation credentials reachable by install scripts as sensitive.
- Do not install, execute, import, run tests against, or sandbox-run the
  malicious package versions.
- Do not print, upload, diff, or preserve harvested secrets. Do not attempt to
  contact payload infrastructure.
- Do not delete unrelated dependencies, remove security controls, or disable
  tests to make the remediation appear clean.
- Do not auto-merge.

## Steps

1. Inventory npm package surfaces controlled by this repository: `package.json`,
   package manager lockfiles, workspaces, vendored modules, Dockerfiles, image
   build contexts, SBOMs, generated dependency reports, registry-mirror config,
   CI caches, and release workflows.
2. Search for all `@tanstack/*` packages and compare resolved versions against
   the exact malicious-version table in the SecurityRecipes entry for
   CVE-2026-45321.
3. If any exact malicious version is present, remove it from manifests and
   regenerate the lockfile from a clean environment with lifecycle scripts
   disabled until the dependency graph no longer resolves an affected version.
4. Upgrade affected packages to the first patched version or newer. If the
   repository cannot upgrade because of framework compatibility, stop with
   `TRIAGE.md` naming the blocker, owner, temporary containment, and follow-up
   date.
5. Delete repository-controlled `node_modules`, package-manager stores, CI
   workspaces, cache keys, build artifacts, and Docker layers that may contain
   the affected tarballs. For internal mirrors or proxy registries, invoke or
   draft the compromised-package cache-quarantine workflow with exact
   `name@version` coordinates.
6. Review CI and release logs for installs of affected versions on or after
   2026-05-11 19:20 UTC. Record which runners, jobs, workstations, and images
   were plausibly exposed. Do not fetch or display secrets from logs.
7. Draft the credential-rotation packet for every exposed environment:
   GitHub tokens, npm tokens, cloud credentials, SSH keys, Kubernetes
   service-account tokens, Vault tokens, package-registry credentials, and
   deployment credentials. Mark rotation as an operator action if this repo
   cannot perform it directly.
8. Audit GitHub Actions workflows for the enabling pattern:
   - `pull_request_target` that checks out fork-controlled refs or runs
     fork-controlled code;
   - caches shared between untrusted PR jobs and trusted release jobs;
   - broad `restore-keys` that allow cache fallback across trust zones;
   - publish workflows with `id-token: write` before build inputs are fixed;
   - npm trusted-publishing jobs that run after restoring untrusted caches.
9. Fix workflow trust boundaries where this repository owns them:
   - use `pull_request` for untrusted code execution;
   - keep `pull_request_target` limited to metadata-only actions;
   - segregate cache keys and cache scopes by trust zone;
   - remove broad fallback restore keys from release jobs;
   - move `id-token: write` to the minimal publish job;
   - build release artifacts from checked, immutable refs and clean dependency
     installs.
10. Add safe regression guards:
    - a dependency guard rejects every malicious exact version;
    - a workflow guard flags `pull_request_target` plus fork checkout or code
      execution;
    - a workflow guard flags release publishing jobs that restore untrusted
      caches while holding `id-token: write`;
    - a tarball-inspection fixture checks for the malicious optional dependency
      and `router_init.js` without executing scripts.
11. Add a PR body section named `CVE-2026-45321 operator actions` that states:
    - which `@tanstack/*` packages and versions were found;
    - which lockfiles, images, caches, and mirrors were regenerated or purged;
    - whether any CI or developer environment installed an affected version
      after 2026-05-11 19:20 UTC;
    - which credentials require rotation and who owns it;
    - which GitHub Actions trust-boundary issues were fixed or triaged;
    - which validation commands passed.
12. Run available validation: clean package install with scripts controlled,
    lockfile integrity checks, dependency guard tests, workflow-policy tests,
    unit tests, build, lint/typecheck, SBOM refresh, image build, and
    dependency/security scans.
13. Use PR title:
    `fix(sec): remediate CVE-2026-45321 TanStack compromise`.

## Stop conditions

- No controlled npm dependency graph, image, CI workflow, package mirror, or
  cache can contain an affected TanStack artifact.
- The only exposure is an externally owned build environment; write
  `TRIAGE.md` naming the owner, evidence, required rotation, and due date.
- Safe verification would require executing a malicious package version,
  contacting payload infrastructure, or exposing secrets.
- Credential rotation is required but cannot be done from this repository;
  document the rotation packet and stop short of claiming full remediation.
- Validation fails for unrelated pre-existing reasons; document those failures
  instead of broadening scope.
~~~

## Verification - what the reviewer looks for

- No repository-controlled manifest, lockfile, SBOM, image, generated report,
  cache policy, or registry mirror still references the exact malicious
  `@tanstack/*` versions.
- The PR was generated from a clean dependency graph and did not execute
  lifecycle scripts for suspected malicious versions.
- CI and developer install exposure was assessed against the 2026-05-11
  malicious publish window, and credential rotation is either completed or
  explicitly assigned as an operator action.
- GitHub Actions workflows do not let fork-controlled code poison caches that
  trusted release jobs restore before npm trusted publishing.
- Regression guards cover both dependency coordinates and Actions
  trust-boundary patterns.

## Watch for

- Treating this as a simple package bump while leaving CI caches, mirrors,
  Docker layers, or developer package stores untouched.
- Updating `package.json` but leaving an affected exact version in `pnpm-lock`,
  `package-lock.json`, `yarn.lock`, SBOM output, or a generated dependency
  report.
- Running `npm install` without disabling scripts while investigating a
  suspected affected version.
- Assuming a read-only `GITHUB_TOKEN` prevents Actions cache writes in
  `pull_request_target` jobs.
- Leaving `id-token: write` on build jobs that restore caches or execute
  dependency-installed binaries before publish-time integrity checks.
- Rotating npm tokens but forgetting cloud metadata credentials, SSH keys,
  Kubernetes service-account tokens, Vault tokens, GitHub CLI credentials, or
  package-registry tokens available to the install environment.

## Output contract

Return one of:

- A reviewer-ready PR/change request that removes exact malicious TanStack
  versions, regenerates clean lockfiles, purges controlled caches/mirrors,
  adds dependency and workflow-policy guards, hardens GitHub Actions
  trust-boundaries, and includes an operator credential-rotation packet.
- `TRIAGE.md` when this repository has no controlled npm dependency graph,
  cache, image, CI workflow, package mirror, or release pipeline exposure that
  can be remediated here.

The output must list packages and versions found, lockfiles/images/caches
changed, install exposure since 2026-05-11 19:20 UTC, credentials requiring
rotation, workflow trust-boundary findings, validation commands, and remaining
owners/due dates. It must not execute malicious package versions, contact
payload infrastructure, preserve harvested secrets, or claim credential
rotation is complete unless the repository actually performs it.

## Rollback

Never restore an exact malicious package version, a lockfile generated on a
potentially compromised host, or a cache that may contain the affected
tarballs. Roll back unrelated application code separately while retaining clean
TanStack versions, rebuilt dependency state, quarantined caches, and completed
credential rotation.

## Related recipes

- [Artifact cache purge]({{< relref "/security-remediation/artifact-cache-purge" >}})
- [Source-code supply chain build integrity audit]({{< relref "/recipes/general/source-code-supply-chain-build-integrity-audit" >}})
- [Compromised package cache quarantine]({{< relref "/recipes/general/compromised-package-cache-quarantine" >}})

## References

- GitHub Advisory: <https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx>
- NVD: <https://nvd.nist.gov/vuln/detail/CVE-2026-45321>
- CVE Record: <https://www.cve.org/CVERecord?id=CVE-2026-45321>
- TanStack postmortem: <https://tanstack.com/blog/npm-supply-chain-compromise-postmortem>
- TanStack tracking issue: <https://github.com/TanStack/router/issues/7383>
- CISA KEV lookup: <https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321>
- [Artifact Cache & Mirror Quarantine]({{< relref "/security-remediation/artifact-cache-purge" >}})

description: CVE-2026-45321 covers 84 malicious TanStack npm versions. Remove exact versions, rebuild cleanly, purge caches, rotate credentials, and harden CI.

maturity: stable

title: CVE-2026-45321: TanStack npm Supply-Chain Remediation

product: tanstack/arktype-adapter

vendor: tanstack

product: tanstack/eslint-plugin-router

product: tanstack/eslint-plugin-start

product: tanstack/history

product: tanstack/react-router

quality: curated

recipe_kind: markdown-override

summary: On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

title: TanStack Unspecified Vulnerability


product: UFO

vendor: microsoft

summary: Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microsoft UFO tagged releases up to and including v3.0.0 contain an OS command injection vulnerability in the shell action replay path. In affected releases, ShellReceiver.run_shell() passes a command string from action parameters directly to subprocess.Popen() with shell=True and executable=powershell.exe. The same shell-execution behavior is also reachable through ShellReceiver.execute_command(). The shell receiver is invoked by action classes such as RunShellCommand.execute() and ExecuteCommand.execute(), which forward stored action parameters to the shell receiver. Because UFO stores planned and executed actions in per-session JSON records, an attacker who can write or modify a session/action JSON file can plant a shell action. When the session is resumed or replayed, UFO executes the attacker's command as the UFO process user.


product: meshcore-card

vendor: jpettitt

summary: MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.


product: go

vendor: tmlmobilidade

summary: Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.


product: tinyice

vendor: DatanoiseTV

summary: TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.


product: esp-idf

vendor: espressif

summary: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c that bridge calls from the user application (i.e. the REE) to TEE-protected hardware peripherals (AES, SHA, ECC, HMAC, SPI, MMU, WDT) and to the security feature like attestation, OTA updates, secure storage. This issue has been patched in versions 5.5.5 and 6.0.1.


summary: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c validated only some of the caller-supplied pointer arguments, leaving input pointer arguments unchecked. Because the underlying TEE-protected hardware peripherals (e.g., ECC, SHA, SPI) run in RISC-V machine mode (M-mode) with full address-space access, a caller could supply pointers into TEE-exclusive memory as inputs, causing the peripheral to read TEE memory and return results derived from it to the REE. Depending on the wrapper, the result contains raw bytes from TEE memory, a computed function of TEE memory recoverable through repeated calls, or a single bit per call that forms an oracle for incremental disclosure of TEE-resident sensitive data. This issue has been patched in versions 5.5.5 and 6.0.1.


product: decidim

vendor: decidim

summary: Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant’s ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.


product: open-webui

vendor: open-webui

vendor: openwebui

summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, validate_url() in backend/open_webui/retrieval/web/utils.py calls validators.ipv6(ip, private=True), but the validators library does NOT implement the private keyword for IPv6 — the call raises a ValidationError (which is falsy in a boolean context), so every IPv6 address passes the filter. In addition, IPv4-mapped IPv6 (::ffff:10.0.0.1) bypasses the IPv4 check entirely, and several reserved IPv4 ranges (0.0.0.0/8, 100.64.0.0/10, 192.0.0.0/24, etc.) are not blocked. This vulnerability is fixed in 0.9.0.


product: automad

vendor: marcantondahmen

summary: Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.


product: kirby

vendor: getkirby

summary: Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature returned lock information without checking the requesting user's access permissions. Kirby's Panel includes a content-locking feature that records which user currently has a model open for editing. This lock prevents conflicting edits by multiple users and displays the locking user's identity in the Panel UI so other users know who to contact. Internally, the locking user's email address and identifier are included in every Panel view payload and in error responses returned when a user attempts to edit a model that is currently locked by another user. This allowed a low-privilege authenticated Panel user, whose role was configured with users.access: false or users.list: false, to learn the email address and identifier of any user who currently had a model open for editing in the Panel, including administrators and other higher-privilege users. Content locks are active for a configurable window (10 minutes by default).


product: WeGIA

vendor: LabRedesCefetRJ

summary: WeGIA is a web manager for charitable institutions. Prior to 3.7.3, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=InternoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.7.3.


product: HireFlow

vendor: StratonWebDesigners

summary: HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secret_key used to sign session cookies, allowing unauthenticated attackers who know the public source value to forge cookies containing role=admin and user_id values and bypass authentication. The advisory lists version 1.3 as fixed.


product: better-auth

vendor: better-auth

summary: Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bind the polling device to the attacker's account or deny the legitimate flow. This issue is fixed in version 1.6.11.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a Server-Side Request Forgery (SSRF) vulnerability exists in _process_picture_url() in backend/open_webui/utils/oauth.py (line ~1338). The function fetches arbitrary URLs from OAuth picture claims without applying validate_url(), allowing an attacker to force the server to make HTTP requests to internal resources and exfiltrate the full response. This vulnerability is fixed in 0.9.0.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI allows admins to restrict which API endpoints an API key can access. When an API key is restricted from /api/v1/messages, requests using the Authorization: Bearer sk-... header are correctly blocked with 403. However, the same key sent via the x-api-key header bypasses the restriction entirely — the request is authenticated, the model is invoked, and a full response is returned. This vulnerability is fixed in 0.9.0.


product: LinkAce

vendor: Kovah

summary: LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, LinkAce contains an Insecure Direct Object Reference vulnerability in the authorization policy layer that allows any authenticated user to modify resources owned by other users. The affected resource types are links, lists, tags, and notes. Both the web UI and the REST API are vulnerable. The root cause is in the update() methods of all four model policies: LinkPolicy, LinkListPolicy, TagPolicy, and NotePolicy. Each delegates to an access-check method (e.g., userCanAccessLink()) that returns true for any resource with non-private visibility, regardless of who owns it. This means any registered user can edit any public or internal resource across the entire instance. The delete() methods in the same policy files correctly require ownership via $link->user->is($user), which confirms that update was intended to be owner-only. The same flaw exists in the API layer through AuthorizesUserApiActions::userCanUpdateModel(), which mirrors the broken visibility-only check instead of the ownership check used by userCanDeleteModel(). Bulk edit operations via BulkEditController are also affected.


summary: LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, LinkAce contains a stored cross-site scripting vulnerability that allows a low-privilege user to execute arbitrary JavaScript in an administrator's browser session. This affects instances configured with SSO/OAuth authentication, which is one of the supported authentication methods in LinkAce. An attacker who sets their OAuth display name to a malicious script and then creates an API token will plant a persistent XSS payload in the audit log. When any admin navigates to /system/audit, the payload executes in the admin's browser context. This enables session cookie theft, CSRF token exfiltration (exposed in the la-app-data meta tag), or any other action the admin can perform. This vulnerability is fixed in 2.5.6.


summary: LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on uninitialized LinkAce instances accepts attacker-controlled database credential fields and writes them back into .env without escaping. A remote attacker who can reach the setup endpoints and supply a database they control can inject mail configuration variables and achieve command execution when the application later sends mail. This vulnerability is fixed in 2.5.6.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.5.7, a user can modify another user's model even if its visibility is set to Private. By changing the access permissions during editing, unauthorized access can be gained. This vulnerability is fixed in 0.5.7.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. This vulnerability is fixed in 0.6.31.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.5.11, there is a blind server side request forgery (SSRF) via the PDF generate function. In the PDF export, user inputs are interpreted as HTML and embedded into the PDF. According to tests, scripts and some potentially dangerous tags (iFrame, Object, etc.) are blocked, preventing server-side content from being read through this vulnerability. However, an image tag can be used to force a server-side request (SSRF), as shown in the following below. This vulnerability is fixed in 0.5.11.


product: pyload

vendor: pyload

summary: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via $(div).html(html). No escaping runs between the API value and innerHTML. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator's browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers. This vulnerability is fixed in 0.5.0b3.dev100.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a user just needs to use the API endpoint: /api/chat/completions with their own API key (generated in OWUI) and the Chat ID of another user to continue the conversation of the other user. This vulnerability is fixed in 0.9.0.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, there is a vulnerability in chat completion API, which allows attackers to bypass tool restrictions, potentially enabling unauthorized actions or access. In the chat_completion API, the parameters tool_ids and tool_servers are supplied by the user. These parameters are used to create a tools_dict by the middleware. This is then used by get_tool_by_id to retrieve the appropriate tool. However, there is no checks in that ensures the user that uses the API has permission to use the tool, meaning that a user can invoke any server tool by supplying the correct tool_id or tool_servers parameters via the chat completion API. Moreover, the authentication token stored in the server would be used when invoking the tool, so the tool will be invoked with the server privilege. This vulnerability is fixed in 0.8.6.


summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.9, when a regular user [non-admin] logs into the application, a http://IP:8080/api/models? web request is initiated by the application and in response, it reveals the system prompt of available models set by admin on models pages in workspace affecting the confidentiality of application. This vulnerability is fixed in 0.8.9.


product: cpp-httplib

vendor: yhirose

summary: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib (httplib.h) parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). Per the C standard (§7.22.1.4), strtoul silently accepts a leading minus sign, performing unsigned wrap-around: strtoul("-2", …, 16) returns ULONG_MAX − 1 (0xFFFFFFFFFFFFFFFE). The library's only guard (line 12833) rejects ULONG_MAX (the result of "-1"), but any other negative value such as "-2" passes validation. The resulting near-maximum value is stored in chunk_remaining and controls how many bytes the server's read loop consumes from the network. This vulnerability is fixed in 0.43.4.


product: electerm

vendor: electerm

summary: electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0.


product: liquidjs

vendor: harttle

description: CVE-2026-45357 is LiquidJS leftover. GHAD first_patched is null. NVD/vendor prose names 10.26.0. leftover 45617 first_patched is 10.26.0.

title: CVE-2026-45357: LiquidJS leftover dump, first_patched null

summary: LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, so a single small template ({{ x | date: '%5000000d' }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls — and which the docstring explicitly mentions for strftime — are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0.


product: ImageMagick

vendor: ImageMagick

product: imagemagick

vendor: imagemagick

summary: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.


summary: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-22.


product: Apache Airflow

vendor: Apache Software Foundation

description: CVE-2026-45360 is Airflow untrusted deserialization. GHAD names 3.2.2 for before 3.2.2. Distinct from leftover 42359's 3.2.0 window.

title: CVE-2026-45360: Apache Airflow untrusted deserialization

product: airflow

vendor: apache

summary: Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom `DeadlineReference` whose serialized form named an attacker-controlled module path, causing the scheduler to `import_string(...)` and instantiate that class with a live SQLAlchemy session attached. Affects deployments where DAG-author code is less trusted than the scheduler process. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.

title: Apache Airflow security vulnerability


product: Apache Airflow Google provider

description: CVE-2026-45361 is Airflow Google SSH host-key skip. GHAD names 22.0.0. Leftover dump text named 22.0.0. Do not invent 22.0.1.

title: CVE-2026-45361: Airflow providers-google ComputeEngineSSHHook host-key skip

product: apache-airflow-providers-google

summary: Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.

title: Apache Apache-Airflow-Providers-Google security vulnerability


product: ruby-jwt

vendor: jwt

summary: ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.


summary: Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it received in x-forwarded-for (or the configured IP-bearing header). IPv6 clients controlling a typical /64 allocation could rotate through 2^64 distinct source addresses without exhausting the per-address counter, defeating rate limiting on /sign-in/email, /sign-up/email, /forget-password, and every other path the limiter protects. The same bug allowed a single client to vary the textual encoding of one IPv6 address (uppercase, compression, IPv4-mapped, hex-encoded IPv4-in-IPv6) and produce multiple distinct keys. This vulnerability is fixed in 1.4.17 and 1.5.0-beta.9.


product: open-webui

vendor: open-webui

summary: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, an internal-only bypass_filter parameter is exposed on the /openai/chat/completions and /ollama/api/chat HTTP endpoints via FastAPI query string binding, allowing any authenticated user to append ?bypass_filter=true and bypass model access control checks to invoke admin-restricted models. This vulnerability is fixed in 0.8.11.


product: typescript-utcp

vendor: universal-tool-calling-protocol

summary: typescript-utcp is a typescript implementation of UTCP. Prior to 1.1.2, the @utcp/http package is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation. registerManual() validates the discovery URL against an HTTPS / loopback allowlist, but callTool() reuses the resolved toolCallTemplate.url directly without revalidating, and the OpenApiConverter blindly trusts whatever servers[0].url an attacker-hosted spec declares. An attacker who hosts a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare e.g. servers: [{ url: "http://127.0.0.1:9090" }] or servers: [{ url: "http://169.254.169.254" }]; the converter then produces tools whose URL points at internal services on the agent host. This vulnerability is fixed in 1.1.2.


vendor: hapifhir

summary: HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.


product: kirby

vendor: getkirby

summary: Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers that produce `<a href="…">` output from editor-supplied field values: the (`link: …)` KirbyTag, the `link`: parameter of the `(image: …)` KirbyTag when it does not resolve to a known file or `self`, the `link` field of the built-in image block, and the HTML importer for the `blocks` field (which accepted the same malicious input as the image block `link` field). While simple `avascript:` URLs were already deactivated by treating them as a relative path and prepending a single slash to the URL, the use of URLs of the format `javascript://x%0A…` bypasses this protection. The `vbscript:`, `data:`, `livescript:`, `mocha:` and `jar:` schemes are affected by the same underlying gap. This issue has been fixed in versions 4.9.1 and 5.4.1.


product: python-utcp

summary: python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3.


summary: python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call. This vulnerability is fixed in 1.1.3.


product: siyuan

vendor: siyuan-note

summary: SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs. POST /api/graph/getGraph, POST /api/graph/getLocalGraph, POST /api/sync/setSyncInterval, POST /api/storage/updateRecentDocViewTime, POST /api/storage/updateRecentDocCloseTime, POST /api/storage/updateRecentDocOpenTime, POST /api/storage/batchUpdateRecentDocCloseTime, and POST /api/search/updateEmbedBlock are registered with model.CheckAuth only, omitting both model.CheckAdminRole and model.CheckReadonly. Each of them writes server-side state, including atomic rewrites of <workspace>/conf/conf.json via model.Conf.Save(). Any caller whose JWT passes CheckAuth, including a publish-service RoleReader (the role assigned to anonymous publish visitors) and a RoleEditor against a workspace where Editor.ReadOnly = true, can hit them This vulnerability is fixed in 3.7.0.


summary: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.


product: CodeWhale

vendor: Hmbown

summary: CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in URL as http://[::1], the SSRF defenses do not work. This vulnerability is fixed in 0.8.26.


summary: CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and auto_approve defaults to true (task_manager.rs:297: auto_approve: Some(true)). When a user approves a task_create call (which requires ApprovalRequirement::Required), they approve what appears to be a benign work prompt. However, the spawned sub-agent silently receives unrestricted, unapproved shell access. This vulnerability is fixed in 0.8.26.


summary: SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan's Bazaar (community marketplace) renders the name and version fields of a package's plugin.json (and the equivalent theme.json / template.json / widget.json / icon.json) into the Settings → Marketplace UI without HTML escaping. The kernel-side helper sanitizePackageDisplayStrings in kernel/bazaar/package.go HTML-escapes only Author, DisplayName, and Description — Name and Version flow through to the renderer raw. The frontend at app/src/config/bazaar.ts substitutes them into HTML template strings via ${item.preferredName} / ${data.name} / v${data.version} and assigns the result to innerHTML. As a consequence, malicious HTML in either field is parsed and executed when a user opens the marketplace tab. This vulnerability is fixed in 3.7.0.


product: decidim

vendor: decidim

summary: Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.


summary: Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. This is because Decidim::DownloadYourDataController#download_file authenticates the export owner but redirects to a signed Active Storage blob URL that is no longer bound to the owner session. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.


summary: Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to download the scanned document without an authenticated Decidim session until the signature expires. Verification-document images are rendered with variant_url(...), which produces signed /rails/active_storage/disk/... links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period. The affected files are verification_attachment blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.


vendor: strukturag

summary: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]` at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is computed from PPS-supplied `colBd[]`/`rowBd[]` arrays without validating the result against `CtbAddrRStoTS.size() == sps->PicSizeInCtbsY`. A malformed PPS that passes `set_derived_values` but encodes geometry inconsistent with the SPS produces a `ctbAddrRS` past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.


summary: libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` in `libde265/decctx.cc`. When decoding a WPP (Wavefront Parallel Processing) HEVC slice, `ctbAddrRS` is computed as `ctbRow * ctbsWidth` inside the entry-point loop. If the PPS/SPS headers are crafted so that this value exceeds `pps.CtbAddrRStoTS.size()`, the subsequent array access `pps.CtbAddrRStoTS[ctbAddrRS]` reads past the end of the allocated vector, triggering a heap-buffer-overflow confirmed by AddressSanitizer. Version 1.0.19 patches the issue.


vendor: rikyoz

summary: bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, there is an arbitrary file overwrite vulnerability via symlink attack on predictable temp files during archive update. This issue has been patched in version 4.0.12.