Author name: UNDERCODE

This vulnerability occurs when OpenBao’s PostgreSQL secrets engine revokes a database role. The engine fails to apply proper SQL quoting

The vulnerability exists in OpenBao’s OCI plugin downloader function `ExtractPluginFromImage()` (located in helper/pluginutil/oci/downloader.go:301). When a plugin is downloaded from an

The vulnerability arises from two root causes. First, the `revision` parameter in a `ResolutionRequest` is passed directly as a positional

The vulnerability exists in the HTTP resolver’s FetchHttpResource function (pkg/resolution/resolver/http/resolver.go lines 279-307). This function calls io.ReadAll(resp.Body) without imposing any size

How the mentioned CVE works: The vulnerability exists in the product custom option file upload handler. OpenMage LTS uses an

The core of this vulnerability is a fail‑open flaw in the UDR service’s `HandlePolicyDataSubsToNotifyPost` function. This handler processes POST requests

The vulnerability resides in Spinnaker’s Echo service, which processes information using Spring Expression Language (SPeL), specifically when handling expected artifacts.

How CVE-2026-39386 Works CVE-2026-39386 is a high‑severity privilege escalation vulnerability affecting Neko, a self‑hosted virtual browser that runs in Docker

The vulnerability arises from PHP’s automatic deserialization of metadata when accessing `phar://` stream wrappers. Functions like getimagesize(), file_exists(), and `is_readable()`

How the CVE works (around 20 lines): The vulnerability exists in Tekton’s Trusted Resources verification system. When matching a resource

A server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could

The vulnerability arises from a race condition in the proxy cache fetcher when handling multiple simultaneous authentication requests. 1. The

How the CVE works (technical details) The vulnerability exists in Magento’s shared wishlist flow (SharedController::cartAction). The endpoint accepts two parameters:

How the CVE works: The vulnerability exists in `set_key()` and `unset_key()` functions of python-dotenv, which use a `rewrite()` context manager

The vulnerability arises because the `public_api` configuration parameter in Glances IP plugin is taken directly from user-controlled config files and

How the mentioned CVE works The vulnerability exists in SignalK server’s WebSocket subscription handling (file subscriptionmanager.ts). Functions `contextMatcher()` and `pathMatcher()`

The vulnerability exists in the Dataflow module of OpenMage LTS versions prior to 20.16.1. When an administrator imports a file

How the mentioned CVE works: The vulnerability arises because Nginx-UI fails to invalidate bearer tokens (JWTs) when an administrator disables

How the mentioned CVE works The vulnerability exists because all WebSocket endpoints in nginx-ui use a `gorilla/websocket` Upgrader with `CheckOrigin`

The vulnerability exists in the API interface of Cisco Catalyst SD-WAN Manager. An authenticated remote attacker with read‑only credentials and

The vulnerability exists because the Cassandra export module (glances/exports/glances_cassandra/__init__.py) directly interpolates the keyspace, table, and `replication_factor` configuration values into CQL

The vulnerability stems from Glances’ REST API (endpoints under /api/4/) being started with glances -w -B 0.0.0.0. In vulnerable versions,

How the CVE works: A reflected Cross-Site Scripting (XSS) vulnerability exists in the backend DataTable widget of October CMS. The

The vulnerability exists in nbconvert when `HTMLExporter.embed_images=True` is enabled. In this mode, the markdown renderer processes image references (e.g., )

The vulnerability exists in nbconvert, a Jupyter tool that converts notebooks to other formats via Jinja templates. The vulnerable component

How the mentioned CVE works: The vulnerability exists because the `load_image()` function in `lmdeploy/vl/utils.py` (lines 64-67) fetches any user-supplied URL

OpenBao’s certificate authentication method contains a flaw when `disable_binding=true` is configured. During a token renewal request, the method attempts to

How the mentioned CVE works (technical details): The vulnerability exists in Winter CMS’s Tailor and CMS editor extensions. A flaw

The vulnerability arises when `cms.safe_mode` is enabled in October CMS. In this mode, the Twig sandbox restricts PHP execution but

CVE-2026-32604 is a critical command injection flaw in Spinnaker’s Clouddriver service that arises when handling gitrepo artifact types. The vulnerability

How CVE-2026-20133 Works CVE-2026-20133 is an information disclosure vulnerability affecting Cisco Catalyst SD-WAN Manager. The flaw stems from insufficient file

How the mentioned CVE works (around 20 lines): The vulnerability resides in the SAML-based SSO authentication handler of Quest KACE

How the mentioned CVE works (technical details): CVE-2023-27350 is an authentication bypass vulnerability in PaperCut NG prior to version 22.0.8.

The vulnerability resides in Zimbra Collaboration Suite’s Classic UI, affecting versions 8.8.15, 9.0, 10.0, and 10.1. It is a stored

How the Mentioned CVE Works The vulnerability is an authenticated remote code execution (RCE) flaw in the Kentico Xperience CMS.

The vulnerability exists in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager. An unauthenticated remote attacker can

The vulnerability resides in JetBrains TeamCity versions before 2023.11.4, specifically within internal REST API endpoints that process file path parameters.

How CVE-2026-24765 works: PHPUnit forwards PHP INI settings to isolated child processes using `-d name=value` command-line arguments without sanitizing INI

How the mentioned CVE works: The vulnerability exists in the `orchard` crate used by Zebra nodes to verify Orchard transactions.

The vulnerability exists in YesWiki bazar module, specifically in tools/bazar/services/EntryManager.php at line 704. The function formatDataBeforeSave() processes user-supplied data from

How the mentioned CVE works (around 20 lines) The vulnerability exists in the DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers

How the mentioned CVE works (technical details, ~20 lines): The vulnerability resides in the deserialization of `addr` and `addrv2` network

How the CVE Works: The vulnerability resides in Nhost’s OAuth identity linking logic. When a user signs in with a

How the mentioned CVE works (technical details): The pretalx backend organiser search uses `innerHTML` string interpolation to render submission s,

How the mentioned CVE works: The vulnerability exists in `fileSystemHandler.prefixed()` at scp/filesystem.go:42-48. This method attempts to confine file operations to

How the CVE Works Zebra’s JSON-RPC HTTP middleware treats a failure to read the incoming HTTP request body as an

How the mentioned CVE works (technical details): The vulnerability resides in Zebra’s transaction verification cache optimization. This cache assumes that

How the CVE works (around 20 lines): The vulnerability stems from a refactoring in Zebra (a Zcash node implementation) that

How the Mentioned CVE Works This vulnerability exists in the deprecated `OpenTelemetry.Exporter.Jaeger` package for .NET. The core issue resides in

How the vulnerability works The vulnerability lies in the email template rendering logic of pretalx, where user-controlled placeholders are interpolated

The vulnerability exists because the `Stream` property in SmtpStream, ImapStream, and `Pop3Stream` is an auto-property with no buffer reset when

How the mentioned CVE works: The vulnerability exists in openclaw versions below 2026.4.9. It allows browser interaction routes (e.g., act/evaluate

How the mentioned CVE works: The vulnerability arises because browser-based interactions such as pressKey and type submit flows lack complete

The vulnerability resides in OpenClaw’s outbound host‑media attachment read helper (src/outbound/media.ts and src/policy/tools.ts). 1. Policy mismatch – The system enforces

The vulnerability stems from two critical flaws in the Java agent injection logic of the OpenTelemetry eBPF Instrumentation (OBI) component.

How the mentioned CVE works (approx. 20 lines): The vulnerability resides in openclaw’s Matrix integration, specifically in how profile configuration

The vulnerability arises because openclaw implements two types of browser interaction routes: “guarded” routes that enforce SSRF navigation policies (e.g.,

The vulnerability arises in OpenClaw versions 2026.4.7 through 2026.4.14 where the webchat tool-result media normalization fails to enforce the configured

The vulnerability exists in the QMD backend’s `memory_get` read path of OpenClaw versions prior to 2026.4.15. When the QMD backend

The vulnerability arises from how openclaw handles exec routing for sandboxed agents. When an agent runs inside a sandbox, it

The vulnerability arises because the OpenClaw gateway, upon startup, resolves the bearer authentication configuration from the secret reference (SecretRef) and

The vulnerability exists in the legacy API authentication mechanism used by Kimai versions prior to 2.x. The `TokenAuthenticator` class handles

The vulnerability exists in the `parse_mcp_command()` function inside src/praisonai/praisonai/cli/features/mcp.py. This function is responsible for parsing MCP server command strings into

How the CVE Works (Approx. 20 lines): Vulnerable Component: The PHP connector of elFinder versions prior to 2.1.48. Trigger Command:

The vulnerability resides in how `math-codegen` processes string literals. When an application passes user‑controlled input to cg.parse(), the library does

The vulnerability exists in openclaw’s handling of Chrome DevTools Protocol (CDP) endpoints. When a browser profile connects to a CDP

How GHSA-85gx-3qv6-4463 Works Dapr supports access control policies (ACL) for service invocation, restricting which methods an app may call on

The vulnerability arises from how go-git handles HTTP redirects during smart-HTTP clone and fetch operations. When a remote repository responds

How the CVE Works (around 20 lines): The vulnerability resides in OpenClaw’s Matrix integration, specifically in how room control-command authorization

The vulnerability exists in Feishu webhook mode of OpenClaw versions prior to 2026.4.15. Two fail-open flaws combine to allow unauthenticated

How the mentioned CVE works: CVE-2026-40315 was initially patched by adding input validation (regex ^[a-zA-Z0-9_]$) to `table_prefix` in `sqlite.py` only.

On Windows, Claude Code versions before 2.1.75 loaded system-wide default configuration from `C:\ProgramData\ClaudeCode\managed-settings.json` without validating directory ownership or access permissions.

How the mentioned CVE works: The vulnerability exists in the GET /api/v1/public-chatflows/:id endpoint. When a public chatflow is requested, the

How the mentioned vulnerability works (around 20 lines): The `read_only` mode in `mcp-neo4j-cypher` versions before 0.6.0 is designed to prevent

How the mentioned CVE works: The voice-call realtime WebSocket endpoint in openclaw versions prior to 2026.4.10 accepts oversized frames without

How the CVE works (technical details): The vulnerability resides in openclaw’s heartbeat owner downgrade mechanism for versions 2026.4.7 through 2026.4.13.

How the mentioned CVE works: The vulnerability resides in openclaw’s collect-mode queue batching mechanism (npm package before version 2026.4.14). When

How CVE-2025-12345 Works: The vulnerability stems from a Mass Assignment flaw in the DocumentStore creation endpoint. The entity uses a

The vulnerability (no assigned CVE in the ) allows an authenticated gateway client with config read access to retrieve unredacted

How the mentioned CVE works: The vulnerability resides in openclaw’s delivery queue recovery mechanism for outbound media messages. When the

How the mentioned CVE works: Microsoft Teams SSO invoke handler within openclaw (npm package) lacks sender authorization checks before processing

The vulnerability arises because openclaw’s browser snapshot, screenshot, and tab routes do not re-validate the final browser target after a

The vulnerability exists in the text-to-speech generation endpoint POST /api/v1/text-to-speech/generate, which is whitelisted in `packages/server/src/utils/constants.ts` (line 41) – meaning no

How CVE-2026-24884 Works The vulnerability is a Partial Fix Bypass of CVE-2026-24884 in the `compressing` npm package (tested on v2.1.0).

How this CVE Works The vulnerability arises from improper handling of a configuration constant during the ODT to PDF conversion

The vulnerability arises from how Sentry handles SAML SSO authentication in multi-tenant environments. Insecure user identity linking allows an attacker

How the mentioned CVE works: The vulnerability exists in the sandbox noVNC helper route of openclaw versions between 2026.2.21 and

How the mentioned CVE works The workspace runtime service fails to sanitize user‑supplied commands. An attacker with agent access (e.g.,

The vulnerability exists in _url_to_size(), a helper function used by `get_num_tokens_from_messages()` to count tokens for image inputs. The function first

How the mentioned CVE works (two HIGH severity flaws): The mapping engine’s `DefaultMaxCollectionItems` cap is silently bypassed when calling `IMapper.Map(source,

How the mentioned vulnerabilities work (technical details): The platform runs in “authenticated” mode but fails to enforce auth on several

How the CVE Works The OAuth provider exposes a `clientPrivileges` authorization hook whose documented action set includes create, as shown

How the mentioned CVE works The vulnerability exists due to a discrepancy between how Fastify’s router handles percent‑encoded characters and

The vulnerability exists in `HTMLHeaderTextSplitter.split_text_from_url()` which validates the initial URL with `validate_safe_url(allow_private=False)` to block internal/private IPs. However, the actual HTTP

The vulnerability stems from missing company‑scope checks in three agent‑key management routes: GET /agents/:id/keys, POST /agents/:id/keys, and DELETE /agents/:id/keys/:keyId. The

How the CVE works (around 20 lines): The vulnerability exists in Paperclip AI v2026.403.0 within the execution workspace lifecycle. The

The vulnerability stems from a fundamental oversight in how Authlib’s cache-backed state storage binds an OAuth flow to a user’s

The flaw resides in the directory listing mechanism of @fastify/static. When the `list` option is enabled, the plugin uses the

The vulnerability exists in Paperclip’s authenticated mode where three API endpoints (POST /api/agents/:id/keys, GET /api/agents/:id/keys, DELETE /api/agents/:id/keys/:keyId) only call `assertBoard(req)`

How the mentioned CVE works (technical details): The vulnerability exists in `PaddingFreeSponge` hashing when input length is not a multiple