Author name: UNDERCODE

CVE-2026-75595 is a critical authentication bypass vulnerability in the Netty framework, specifically within its `netty-handler` module. The flaw resides in

TagReference.create() forwards a caller-influenced positional reference value into git tag without it ever being inspected by the unsafe-option guard, allowing

Sensitive information exposure (CWE-522) exists in the Infracost Terraform Cloud/Enterprise integration. Several code paths within `internal/hcl/remote_variables_loader.go` and related request paths

GitPython’s GitConfigParser implements a custom reader/writer for git‑config files. The reader (_read()) supports standard git multi‑line quoted values: a quoted

Excel::store() resolved the destination path against the process working directory rather than the configured filesystem disk. When that path resolved

Repo.blame() and Repo.blame_incremental() in GitPython use a denylist (unsafe_git_revision_options) intended to block dangerous options passed via revision strings. However, this

CVE-2026-85880 is a heap-based buffer overflow vulnerability within the Windows Advanced Local Procedure Call (ALPC) subsystem. The ALPC mechanism is

NLTK（Natural Language Toolkit）是一个广泛使用的 Python 自然语言处理库，拥有超过 14000 个 GitHub Star 和超过十亿次的下载量。在其 3.10.0 之前的版本中，nltk.text 模块的 `Text.findall()` 和 `TokenSearcher.findall()` 方法存在一个正则表达式拒绝服务（ReDoS）漏洞，该漏洞被追踪为 CVE-2026-80205。 该漏洞的根本原因在于，这些方法接受用户提供的正则表达式模式，并将其直接传递给 Python

How CVE-2026-85063 Works The `csv-parse` component of the `node-csv` library is a full-featured CSV parser that transforms CSV data into

CVE-2026-83607 is a vulnerability in the @xmldom/xmldom library where `Document.createElement()` accepts arbitrary strings as the tagName parameter without validation. The

CVE-2026-62815 is a critical use-after-free (CWE-416) vulnerability in Microsoft’s QUIC implementation. Microsoft QUIC is a foundational transport layer protocol designed

CVE-2026-75650 is a critical remote code execution vulnerability affecting Adobe Commerce and Magento Open Source, rated 10.0 on the CVSS

CVE-2026-71493 is a path traversal vulnerability affecting the Infracost config-template parser prior to version 0.10.45. The flaw resides in four

CVE-2026-86218 is a critical pre-authentication remote code execution vulnerability affecting N-able N-central, an on-premises remote monitoring and management (RMM) platform.

An integer overflow in the `act_and_mul_kernel` kernel within vLLM can cause the output of one user request to be incorporated

Netty’s default SNI entrypoint is vulnerable to a denial-of-service attack due to an inefficient algorithmic complexity issue. The flaw exists

The NLTK library’s TransitionParser.parse() method deserializes model files using pickle_load() with the default restricted=False parameter, allowing arbitrary Python code execution

NLTK versions prior to 3.10.3 utilize Python’s standard `xml.etree.ElementTree` library for XML parsing across several modules. By default, this parser

The vulnerability exists in the NLTK library’s IPIPANCorpusReader class, specifically in the _get_tag() method. This method is called by public

NLTK (Natural Language Toolkit) versions prior to 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors. The core issue

The vulnerability, identified within NLTK’s pickle security module, stems from an allowlist bypass that permits remote code execution during deserialization.

NLTK before 3.10.3 contains a server-side request forgery vulnerability in `nltk.pathsec.urlopen` (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is

CVE-2026-62384 is a symlink-based sandbox bypass vulnerability in the NLTK (Natural Language Toolkit) library. It affects the `FramenetCorpusReader` component and

NLTK versions before 3.10.0 contain a path traversal vulnerability in `FramenetCorpusReader` and `NKJPCorpusReader` that allows attackers to parse XML files

NLTK (Natural Language Toolkit) implements a path security module (nltk.pathsec) that enforces a trusted‑root boundary when opening corpus files. When

NLTK versions before 3.9.4 contain a symlink escape vulnerability in `CorpusReader.open()` that allows local attackers to read arbitrary files outside

NLTK’s package downloader in `nltk/downloader.py` does not verify file integrity after download and before extraction. The download flow at lines

The vulnerability resides in the `FileSystemPathPointer.open()` method within the `nltk/data.py` module. A historical security patch attempted to enforce a sandbox

NLTK (Natural Language Toolkit) versions before 3.10.0 contain an arbitrary local file read vulnerability in the `StreamBackedCorpusView` component that bypasses

Several static‑file routes in the server mux (kernel/server/serve.go) are registered with `CheckAuth` only and serve directories directly, without the publish‑access

CVE-2026-72795 exposes a critical access control flaw in SiYuan Note’s publish module. The vulnerable endpoints, `/api/block/getBlockDOMWithEmbed` and /api/block/getBlockDOMsWithEmbed, are intended

CVE-2026-72798 exposes two distinct logic flaws in Anytype’s publish-access filter (FilterViewByPublishAccess) used by the `renderAttributeView` API endpoint. The filter is

This vulnerability exposes the server’s session-cookie signing key due to an oversight in the masking chain. The route `/api/system/getConf` is

The OpenChoreo control-plane cluster-gateway exposes internal management endpoints (/api/proxy/, /api/exec/, /api/wirelogs/) that tunnel requests to connected data planes’ Kubernetes APIs.

This vulnerability, identified as CVE-2026-72793, affects SiYuan Note versions prior to v3.7.4. The core issue resides in the `/api/system/getConf` endpoint.

The vulnerability exists in the @typespec/spector package (version 0.1.0-alpha.26) where the Express server registers an administrative route POST /.admin/stop without

SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes. The vulnerability exists in the

The vulnerability resides in the route POST /api/notebook/getEncryptedNotebookStatus, which is exposed without proper publish‑access filtering. The route is registered in

How CVE-2026-73555 Works When the vLLM API receives a malformed request—such as invalid JSON or missing required fields—FastAPI raises a

The vulnerability in CVE-2026-72792 arises from an authorization bypass in SiYuan Note’s tag retrieval endpoint. The `/api/tag/getTag` endpoint is designed

CVE-2026-72799 affects SiYuan Publish’s filetree API. Five endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, getHPathByPath) lack publish‑access checks. They are only protected

SurrealDB versions prior to 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within `PERMISSIONS` clauses execute with enforcement disabled.

Intro The vulnerability exploits a flaw in CodeWhale’s DNS-pinning logic, allowing an attacker to bypass Server-Side Request Forgery (SSRF) mitigations.

SurrealDB provides built-in HTTP functions (http::) that enable database queries to interact with external network endpoints. To restrict which endpoints

CVE-2026-72801 affects SiYuan’s publish mode. Two CheckAuth-only endpoints, /api/system/getConf and /api/notebook/getNotebookConf, expose sensitive cryptographic material to unauthenticated remote clients when

The vulnerability resides in Anytype’s publish graph endpoints, specifically getGraph and getLocalGraph, which are responsible for returning node-link topology of

CVE-2026-72806 is an authentication bypass vulnerability identified in the SiYuan note-taking platform. The flaw resides within the `FilterViewByPublishAccess` filter, specifically

CVE-2026-72803 details an information disclosure flaw in SiYuan Note’s publish API. The vulnerability resides in the `/api/attr/getBlockAttrs` and `/api/attr/batchGetBlockAttrs` endpoints.

The vulnerability in CVE-2026-72802 arises from a discrepancy in how SiYuan Note handles sensitive path information across different API endpoints.

CVE-2026-72800 exposes three API endpoints in Anytype’s publish mode that fail to enforce publish‑access filtering, enabling an attacker with a

CVE-2026-72807 describes a second-order SQL injection vulnerability in SiYuan’s Attribute-View (AV) template columns. AV template columns are evaluated live during

Intro: CVE-2026-72808 is an authorization bypass vulnerability in the Siyuan publishing server component, specifically within the `/api/asset/getFileAnnotation` endpoint. This endpoint

The vulnerability resides in SiYuan Note’s publish API handlers, specifically within kernel/api/block.go. The `getBlockInfo` endpoint correctly gates access using `checkBlockPublishAccess`

Decoding attacker-controlled TOON containing a __proto__, constructor, or `prototype` key wrote through the object’s prototype chain instead of creating an

The vulnerability resides in the `toml.parse()` function of the npm package `toml` (versions up to and including 4.1.2). The parser

CVE-2026-72810 is a missing-authorization vulnerability (CWE-862) in SiYuan Note that allows unauthenticated attackers to establish a WebSocket connection to the

Intro ApostropheCMS enforces per‑type authorization on pages through `editRole` and `publishRole` declarations. The `move()` operation is designed to ensure that

CVE-2026-68587 is an information disclosure vulnerability in SiYuan. It affects three HTTP endpoints that handle heading transactions. These endpoints are

The /api/search/fullTextSearchAssetContent endpoint exposes two SQL injection flaws. Both flaws affect the asset-content database. They are reachable by the publish

The vulnerability resides in the pick, ignore, filter, and `replace` path filters – the core “surgical extraction” feature of the

`toml.parse()` writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.create(null), which neutralizes

Orval is a popular OpenAPI client generator that produces strongly-typed HTTP clients for frameworks like axios, fetch, react-query, and swr.

The vulnerability resides in the asymmetric access control between two sibling API endpoints within SiYuan’s publish module. The `/api/block/getBlockInfo` endpoint

The backlink/mention search query in SiYuan’s kernel/model/backlink.go constructs a SQL MATCH statement by concatenating stored block metadata (, name, alias,

How CVE-2026-73295 Works Material for MkDocs is a widely adopted documentation framework built on top of MkDocs, offering enhanced styling

The /api/search/searchEmbedBlock endpoint in Siyuan passes a client-supplied SQL statement verbatim to the database without any validation. The endpoint is

CVE-2026-56812 is a high-severity vulnerability (CVSS 7.5/10) in the Phoenix JavaScript presence client (assets/js/phoenix/presence.js). The flaw arises from a bare

CVE-2026-68586 details a serious authorization bypass in the SiYuan note-taking application’s backlink API. The API is functionally separated into list

Phoenix transports do not limit the number of channels that a single transport process may join. Every `phx_join` message a

A vulnerability exists in the amqp091-go client library where a compromised or malicious AMQP broker can force the client to

SiYuan’s publish mode implements a “protected” access level, which makes documents publicly listed but password-protected for reading. The primary endpoint

Semaphore UI is an open-source project management and deployment tool. A critical privilege escalation vulnerability exists in how the application

A mutation-XSS / allowedTags bypass occurs when `textarea` (or xmp) is included in allowedTags. An input containing a literal “

Semaphore UI is a web interface designed for managing DevOps tools. Prior to version 2.18.21, the `/api/users/{id}/password` endpoint accepts a

CVE-2026-69086 exposes a path‑traversal vulnerability in four attribute‑view read endpoints of the publish service. The core issue lies in how

Technical Intro: CVE-2026-72809 details a critical authentication bypass vulnerability discovered in the SiYuan kernel. The flaw resides in the `CheckAuth`

CVE-2026-72812 exposes a critical authorization flaw in SiYuan Note’s publish service. The vulnerable endpoint is /api/ref/refreshBacklink, which is intended for

How CVE-2026-71864 Works Orval is a popular tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger

Orval is a popular open-source tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.

Intro ffuf is a fast web fuzzer written in Go. Prior to version 2.2.0, ffuf allowed a malicious target server

Orval is a build-time development tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.

The vulnerability resides in Alist’s offline-download endpoint at POST /api/fs/add_offline_download when the “tool” parameter is set to “SimpleHttp”. This handler

Orval is a tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. The vulnerability

How CVE-2026-71867 Works Orval is a popular tool that generates type-safe JavaScript clients and mock services from OpenAPI and Swagger

Orval’s zod schema generator creates module-level template literals for default values. These are emitted as export const …Default =v${…}w; without

CVE-2026-61625 is a path traversal vulnerability (CWE-22) identified in the `vmrestore` utility of VictoriaMetrics, a scalable time-series database solution. The

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. From version 10.26.0 until 10.27.1, the `strip_html` filter

How CVE-2026-62188 Works OpenClaw is a personal AI assistant framework that integrates with various messaging platforms, including Feishu (Lark), through

CVE-2026-56743 is a medium-severity vulnerability in Cilium, a networking and security solution for Kubernetes. The flaw affects Cilium versions 1.19.0

The vulnerability resides in OpenClaw’s Feishu permission integration, specifically within the `PermissionManager` module that handles per‑account disablement flags. In affected

The vulnerability resides in the `unstructured` Python library, widely used as the URL ingestion layer for LangChain, LlamaIndex, Chainlit, and

SiYuan before v3.7.2 contains a path traversal vulnerability in the `/export/temp/` short-circuit branch of the `serveExport` handler (kernel/server/serve.go). The vulnerability

The vulnerability arises from two critical code paths that fail to sanitize error output before returning it to the caller.

SiYuan cleans user-supplied SVG with util.SanitizeSVG. This acts as the primary guard behind Editor.AllowSVGScript. The setting is off by default,

Hurl is a command-line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and

How CVE-2026-63490 Works CVE-2026-63490 is an unauthenticated arbitrary file read vulnerability affecting the `handlebars-springmvc` library prior to version 4.5.3. The

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent

The vulnerability resides in the SeaweedFS Filer component, specifically within the JSON Web Token (JWT) authorization middleware implemented in weed/server/filer_server_handlers.go.

The OpenChoreo autobuild webhook endpoint (POST /api/v1alpha1/autobuild) contains an authentication bypass vulnerability that allows unauthenticated attackers to trigger builds. The

How CVE-2026-83548 Works CVE-2026-83548 is a critical pre‑authentication Server‑Side Request Forgery (SSRF) vulnerability that resides in the Appliance Work Place