Author name: UNDERCODE

The OIDC back-channel logout endpoint accepts logout tokens from an identity provider. It is unauthenticated by design because the provider

The mistral.rs inference server, a Rust-based OpenAI-compatible platform, contains a critical vulnerability in its media loading logic within the `mistralrs-server-core`

Traefik v3 entrypoint defenses scan req.Header only. They never scan req.Trailer. aliasHeadersStrategy delete/reject is affected. underscoreHeadersStrategy delete/reject is affected. forwardedHeaders

Traefik accepts HTTP/1.x rootless/opaque request-targets such as GET http:http://internal-vhost/admin HTTP/1.1. Go parses this target with url.ParseRequestURI into URL.Opaque while URL.Path

Open WebUI external tool servers can leak session cookies across connections. The flaw affects the tool loading routine in backend/open_webui/utils/tools.py.

CVE-2026-46600 is a high-severity request-smuggling vulnerability in Traefik’s HTTP reverse proxy. The flaw resides in how Traefik handles the HTTP/1.1

Open WebUI stores folders as parent references. The re-parent endpoint accepts a new parent_id. It did not verify the new

rclone’s `backend/local` with the `–links` flag (-l) or `links=true` configuration option exposes filesystem symlinks as rclone objects. Each symlink becomes

POST /api/acp/agents registers a custom ACP agent. The endpoint accepts user-controlled `binary` and `versionCommand` values. After saving the custom agent,

CVE-2026-86084 is an authentication bypass vulnerability affecting n8n, an open-source workflow automation platform. The flaw resides in the enterprise edition’s

n8n is an open source workflow automation platform. Prior to versions 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger node generated

Technical CVE-2026-86083 is a critical code injection vulnerability that affects the legacy expression engine in n8n, an open-source workflow automation

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks such as href, src, action, xlink:href, and data to protect

CVE-2025-66677 affects Traefik HTTP/3 request handling. The respondingTimeouts.readTimeout setting is documented for incoming requests. It is meant to cap the

An XSS vulnerability exists in @angular/platform-server during server-side rendering (SSR) HTML serialization when traversing ancestor tags across template element boundaries.

A SQL injection vulnerability exists in Pimcore Custom Reports bundle. File bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php lines 84-135. Authenticated attacker with reports_config permission can

n8n is an open source workflow automation platform that allows users to connect various services and automate tasks through a

CVE-2026-86994 is a missing authorization vulnerability in n8n, an open-source workflow automation platform. The vulnerability resides in the `/rest/active-workflows` endpoint,

RouterOS accepts a “related” btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this

CVE-2026-86078 is a prototype pollution vulnerability in n8n, an open source workflow automation platform. The flaw resides in the Instance

CVE-2026-86079 is a path injection vulnerability affecting n8n, an open source workflow automation platform. The flaw exists in the Elasticsearch

Traefik canonicalizes HTTP header names by dashes only. Therefore X-Auth-User, X_Auth_User, and X.Auth.User remain distinct inside Traefik. Backends such as

to CVE-2026-86993 CVE-2026-86993 is a missing authorization vulnerability (CWE-862) in n8n, an open-source workflow automation platform. The flaw resides in

Angular SSR processes server-side requests through @angular/platform-server. Its URL resolution utilities include resolveUrl and parseUrl. In affected behavior, those utilities

CVE-2026-50170 affected @angular/common when SSR and hydration were enabled. HttpTransferCache cached outgoing HTTP requests during SSR. Cached state transferred to

CVE-2026-87995 is a same-origin cross-site scripting vulnerability in Open WebUI, an extensible self-hosted AI platform. The flaw resides in the

CVE-2026-54063 is the prior row-bound fix for GHSA-h69g in Excelize. The checked worksheet parser validates row numbers before allocating sheet

Open WebUI exposes chat-completions endpoints. The affected paths are POST /api/chat/completions and POST /api/v1/chat/completions. The handler lives in backend/open_webui/main.py. It

Open WebUI is an extensible, self-hosted AI platform that fetches user-supplied URLs on the server side for two purposes: RAG

CVE-2026-86081 is a Regular Expression Denial of Service (ReDoS) vulnerability in n8n, an open-source workflow automation platform. The flaw resides

The built-in knowledge search tool resolves which knowledge bases the caller may read. It passes that readable set to the

Open WebUI is a self-hosted AI platform that relies on external OAuth providers for authentication. From version 0.8.0 through 0.9.0,

n8n uses expressions for workflow automation. Expressions are compiled and sanitized before evaluation. The sanitizer is intended to block dangerous

CVE-2026-87996 is a Time-of-check Time-of-use (TOCTOU) vulnerability in Open WebUI’s `SafePlaywrightURLLoader` that allows an authenticated user to bypass SSRF protections

CVE-2026-86075 is an unauthenticated resource-exhaustion vulnerability in n8n’s OAuth Dynamic Client Registration endpoint. The endpoint validated field sizes only for

CVE-2026-86082 is a high-severity Server-Side Request Forgery (SSRF) and credential leakage vulnerability affecting the n8n open-source workflow automation platform. The

Open WebUI external knowledge connections are admin-owned. They are shared by every external knowledge base bound to them. The delete

docx-preview renders DOCX in browser. It reads word/fontTable.xml. Embedded font-family names are extracted. Names are interpolated into injected @font-face style.

Excelize parses shared-string cell values with strconv.Atoi. It checks only the upper bound before indexing the shared string slice. If

The Home Assistant ESPHome add-on dashboard serves a trusted ingress site that intentionally skips authentication because the supervisor’s ingress proxy

Open WebUI stores chat histories as unvalidated JSON objects. The message-chain reconstruction walk rebuilds a chat’s history. It detects repeats

The session_token cookie is set without SameSite or Secure attributes at login.go:68. All /api/admin/ management endpoints rely solely on this

CVE-2026-59172 is an arbitrary code execution vulnerability affecting the Joker Clojure interpreter, linter, and formatter in versions prior to 1.8.2.

@yeger/turbo-graph exposes an embedded Next.js server. The server starts without binding to the loopback interface. It listens on all network

[email protected] unconditionally merges all module options into Nuxt public runtime config. The module options include api_key when configured for cloud

CVE-2026-55864 is an unauthenticated server-side request forgery (SSRF) vulnerability in the GeoNetwork Web Module, specifically within the SLD tooling endpoint.

Intro Open WebUI stores chat histories as an unvalidated JSON object. The vulnerable code is the chat-history message deletion helper

This vulnerability affects webhook systems prior to version 1.22. When the Basic Auth (htpasswd) middleware is not configured, the system

FlowStore.filePath() in packages/server/src/store.ts:52–53 constructs filesystem paths. It concatenates caller-supplied id directly into path.join. The code returns join(this.dir, `${id}.yaml`). No sanitization

The vulnerability is in identrail’s GitHub App connection-completion endpoint. It accepts a client-supplied installation_id. The installation_id is not verified against

CVE-2025-25249 – 技术深度分析 CVE-2025-25249 是存在于 Fortinet FortiOS 与 FortiSwitchManager 产品中的堆溢出漏洞，漏洞根源在于 `cw_acd` 守护进程在处理特制网络数据包时，未能对堆内存分配的边界进行有效校验。 `cw_acd` 是 Fortinet 设备中负责 CAPWAP（Control And Provisioning of

CVE-2026-19490 is a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances. The flaw resides in the

A critical vulnerability identified as CVE-2026-20079 exists in the web interface of Cisco Secure Firewall Management Center (FMC) Software. This

smol-toml is a small, fast, and correct TOML parser and serializer for JavaScript/TypeScript applications. Prior to version 1.7.1, the library’s

The vulnerability in GitHacker versions up to 1.1.7 arises from insufficient validation of path segments parsed from attacker‑controlled `.git/HEAD` content.

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government. This stored

SQLAdmin is a popular administrative interface for SQLAlchemy-based applications, providing developers with a convenient way to manage database models through

A bug in containerd’s CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd’s

A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service

Server-side request forgery (SSRF) vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to

A path traversal vulnerability exists in eKuiper’s administrative management endpoints, identified as CVE-2025-58363. This flaw allows privileged users or attackers

The vulnerability CVE-2026-69304 resides in the ASP.NET Core IIS out-of-process hosting module, specifically within the request decompression middleware. When ASP.NET

The vulnerability resides in the native component Microsoft.DiaSymReader.Native, a library responsible for parsing Portable PDB (Program Database) files that contain

The vulnerability exists in the `gix-sec` crate, a component of the `gitoxide` project, which is a pure Rust implementation of

CVE-2026-69522 is a high-severity remote code execution vulnerability affecting Microsoft .NET and Visual Studio. The flaw resides in the `Microsoft.DiaSymReader.Native`

The @typespec/openapi3 emitter interpolates a @versioned enum member’s value directly into the output filename as the `{version}` token. No sanitisation

Composer is a dependency manager for the PHP language. A remote code execution vulnerability exists in Composer versions from 1.0

Technical Overview multer is a widely-used middleware for Node.js applications to handle `multipart/form-data` requests, commonly used for file uploads. This

multer is a widely used Node.js middleware for handling `multipart/form-data` uploads. In version 2.2.0, a critical flaw exists in the

The Nodemailer library’s address parser (lib/addressparser/index.js) processes a comma‑separated list of email addresses with quadratic time complexity relative to the

The vulnerability resides in the `serve/cli_api.py` component of the `winml-cli` project, which exposes all winml CLI commands over HTTP without

The multer middleware for Node.js is widely used to handle multipart/form‑data, specifically file uploads. It provides a `limits.fileSize` option to

How CVE-2026-84363 Works Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.13.5,

The Nodemailer email-address parser mishandles RFC 5322 comments within the domain portion of an email address, treating them as a

The vulnerability arises from an incomplete patch for CVE-2026-5078 within the Morgan HTTP request logger middleware for Node.js. Morgan is

The mentioned vulnerability (no CVE assigned yet) affects @tiptap/core, a popular library for building rich text editors. It contains two

Multer is a widely used Node.js middleware for handling `multipart/form-data` requests, commonly employed in web applications to process file uploads

js-yaml is a popular JavaScript library used for parsing and dumping YAML (YAML Ain’t Markup Language) content. A significant vulnerability

How GHSA-26w7-cxv4-gfx2 Works Astro, a popular web framework for content-driven websites, relies on the default Sharp image service to optimize

A critical vulnerability has been discovered in Next.js that allows unauthenticated attackers to execute arbitrary code remotely via the Image

The `sharp` npm package, a high-performance Node.js image processing library, relies on the upstream `libheif` library to decode and encode

n8n is an open-source workflow automation platform that enables users to create complex automated processes by connecting various nodes. A

SVGO (SVG Optimizer) is a widely used Node.js library and command-line tool for optimizing SVG files. The `removeScripts` plugin (known

CVE-2025-13033 addresses an interpretation conflict in Nodemailer, where the email library resolves internationalized (IDN/non-ASCII) recipient domains to a different Punycode

CVE-2026-84308 is a vulnerability in the phpseclib PHP secure communications library. Prior to versions 3.0.57 and 4.0.1, the pure-PHP X25519

How CVE-2026-81525 Works CVE-2026-81525 is a high-severity improper input validation vulnerability in the MongoDB client library for PHP. The library

Astro is a web framework for content-driven websites. Prior to version 7.2.4, Astro stripped a configured non-root base path from

A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:authority` and `Host` headers can

The vulnerability exists in the processing-instruction (PI) grammar regex defined in lib/grammar.js. The regex `^` compiles with the `mu` flags.

The vulnerability arises from a parity oversight in GitPython’s configuration‑parser construction. The `GitConfigParser` class defaults merge_includes=True, meaning any config file

The isBlockedIP function in Dozzle’s webhook notification dispatcher is intended to prevent Server-Side Request Forgery (SSRF) attacks by blocking loopback,

CVE-2026-81963 is a locally exploitable elevation of privilege vulnerability residing in the Windows Update Stack component of Microsoft Windows and

Element.setAttribute() in @xmldom/xmldom bypasses attribute name validation by calling the private `_createAttribute(name)` method, which performs no validation. The public `createAttribute()`

This vulnerability arises from a critical omission in GitPython’s denylist for unsafe `git clone` options. The `Repo.clone_from()` and `Repo.clone()` APIs

A remote code execution vulnerability exists in Windows Presentation Foundation (WPF) in .NET 8, .NET 9, and .NET 10 when

Prowler’s HTML output formatter in `prowler/lib/outputs/html/html.py` inserts `finding.resource_tags` into the generated report without HTML escaping. A cloud principal who can

NLTK versions prior to 3.10.3 contain a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The `_tgrep_node_action`

The vulnerability exists in the `join` filter implementation located in `src/filters/array.ts` (lines 8-13). The filter calculates its memory consumption charge

NLTK versions before 3.10.3 contain a regular expression denial of service (ReDoS) vulnerability in the `Pl196xCorpusReader` component. The vulnerable code

CVE-2026-75595 is a critical authentication bypass vulnerability in the Netty framework, specifically within its `netty-handler` module. The flaw resides in