Author name: UNDERCODE

The vulnerability arises from improper input validation when processing attacker-controlled protobuf definitions. Specifically, when the application compiles protobuf definitions into

The vulnerability arises from an inadequate validation function, is_relative_url(), which is intended to only allow same-origin redirects after a user

How CVE-2023-38491 works: The authenticated middleware in Budibase uses unanchored regular expressions to match public (no‑auth) endpoint patterns against ctx.request.url.

The vulnerability resides in the `setSafeProperty` function of the mathjs expression parser. Before patching, this function did not adequately restrict

How the CVE works (technical details): The `MarkdownBody` component (shared across issues, comments, chat, approvals, etc.) passes `urlTransform={(url) => url}`

How the mentioned CVE works: The vulnerability allows an attacker with an Agent API key to execute arbitrary OS commands

How the CVE Works The vulnerability exists in Saltcorn’s mobile-sync routes (POST /sync/load_changes and POST /sync/deletes). The `getSyncRows()` function (lines

How the CVE Works: The vulnerability stems from insufficient separation between agent-controlled configuration and server filesystem access. Attackers with an

How the mentioned CVE works The vulnerability resides in `@angular/platform-server` due to improper URL handling during Server-Side Rendering (SSR). When

How CVE-2026-28208 Works The vulnerability exists in the `LocalFolderExtractor` component of Junrar, a Java RAR extraction library. It stems from

How the mentioned CVE works (technical details): The vulnerability resides in Flowise’s Faiss and SimpleStore (LlamaIndex) vector store implementations. Both

How the Mentioned CVE Works Two command injection flaws exist in the `npm/install.js` script of the electerm terminal emulator. The

Permitted subtree name constraints for DNS names were incorrectly accepted for certificates that assert a wildcard name. In X.509 PKI,

The vulnerability resides in the `CustomMCP` node, which is designed to connect to external Model Context Protocol (MCP) servers. When

How the CVE works: Weblate uses string prefix checks (startswith) on resolved absolute paths to enforce repository boundaries. This check

The vulnerability exists in Hot Chocolate’s Utf8GraphQLParser, which implements a recursive descent parser without any recursion depth limit. An attacker

The vulnerability exists in Mojic v2.1.3’s `CipherEngine.js` during HMAC-SHA256 verification. The decryption routine compares the computed HMAC digest (calcDigest) with

The vulnerability arises from improper sanitization of the `cloneSiteURL` parameter in the `cloneClient.json.php` endpoint of the CloneSite plugin. At line

The vulnerability resides in the `/api/v1/loginmethod` endpoint. The API is designed to manage SSO configurations for organizations. However, it suffers

The vulnerability exists in `controller/unaccess.go` within the `unaccessHandler.Handle` function (line 56). The ownership guard contains a logical error: when a

How CVE works (around 20 lines): Commit 49d0bb7 introduced a regression in sanitize-html. The vulnerable code at `packages/sanitize-html/index.js:569-573` assumes `htmlparser2`

The vulnerability stems from the `proxyUi` template engine using Go’s `text/template` (which performs no HTML escaping) instead of html/template. The

The vulnerability exists in OpenClaw’s `exec` script preflight validator. The vulnerable code path performed two distinct operations on a file

The vulnerability exists in the upload PATCH flow under /files/:uploadId. The outer middleware validates the request path using the still-encoded

This vulnerability arises from weak hardcoded default secrets for JWT authentication. In the affected code (packages/server/src/enterprise/middleware/passport/index.ts:29-34), the application defines `jwtAudience`

How CVE-2026-40303 Works The vulnerability resides in the `GetSessionCookie` function, which handles “striped” (chunked) session cookies. It parses an attacker-controlled

How the mentioned CVE works: The vulnerability resides in the token encryption mechanism when the TOKEN_HASH_SECRET environment variable is absent.

The vulnerability arises because the Express.js session secret defaults to the hardcoded string ‘flowise’ when the environment variable `EXPRESS_SESSION_SECRET` is

How the mentioned CVE works The vulnerability resides in the improper validation of the `code_verifier` parameter during the OAuth 2.0

This vulnerability, currently tracked under GitHub Security Advisory GHSA-4jjr-vmv7-wh4w, affects Statamic CMS, a popular Laravel‑based content management system. It stems

The vulnerability stems from the `webpki` library’s mishandling of the X.509 `nameConstraints` extension for Uniform Resource Identifier (URI) names. The

How the mentioned CVE works: The Jolokia JMX-HTTP bridge is exposed at `/api/jolokia/` on the ActiveMQ web console. The default

The Froxlor API endpoints `Customers.update` and `Admins.update` fail to validate the `def_language` parameter against the list of available language files.

The vulnerability stems from an oversight in how the LangSmith SDK handles output redaction during streaming LLM responses. The SDK

How the mentioned CVE works: The vulnerability exists in the `/config/gym-config/edit` endpoint implemented by GymConfigUpdateView. The view declares `permission_required =

How the CVE Works The `AbstractLicenseModel.attribution_link` property in `wger/utils/models.py` builds an HTML string by directly concatenating user-controlled fields (license_author, license_,

How the mentioned CVE works: The vulnerability exists in Renovate versions 43.65.0 through 43.102.11 when `lockFileMaintenance` is enabled for the

How the mentioned CVE works (approx 20 lines): The vulnerability exists in `@fastify/express` v4.0.4 when Fastify’s router normalization options are

The vulnerability resides in the Tiano/EFI decompressor used by the uefi-firmware project, specifically in the `ReadCLen()` function within Decompress.c. The

How the mentioned CVE works (around 20 lines): The vulnerability resides in `@fastify/express` v4.0.4, specifically in the `onRegister` function (index.js

The vulnerability exploits a race condition caused by the `set_session_cookie_secure` function, which is registered as a `before_request` handler. This function,

The vulnerability arises from an incomplete AST-based blocklist in PySpector’s PluginSecurity.validate_plugin_code. The validator maintains a set `fatal_calls` that explicitly forbids

The vulnerability resides in the `MakeTable()` function of the native Tiano/EFI decompressor used by the `uefi-firmware` Python package. The flaw

The vulnerability allows attackers to strip proxy-added headers via the client’s `Connection` header. It exists because `@fastify/reply-from` copies all client

The vulnerability exists in Froxlor’s API command `Domains.add()` because the `adminid` parameter is accepted from user input without proper validation

The vulnerability exists in DOMPurify’s tag filtering logic within `src/purify.ts` at lines 1117–1123. The core issue is a short‑circuit evaluation

The vulnerability exists because DomainZones::add() lacks a whitelist for DNS record types. The ‘type’ parameter from user input is accepted

The vulnerability exists in Froxlor’s `PhpHelper::parseArrayToString()` (lib/Froxlor/PhpHelper.php:486). This function writes string values into single-quoted PHP string literals without escaping single

The vulnerability stems from an incomplete patch for CVE-2023-6069. After that fix, symlink validation was added to `FileDir::makeCorrectDir()` via a

The vulnerability stems from a flaw in Thymeleaf’s expression evaluation sandbox. The library allows templates to execute expressions (e.g., ${…}),

The vulnerability is a parser‑validator differential caused by inconsistent handling of a leading space character (\x20) in the `Content‑Type` header.

Attackers exploit the JsonMapper instance within LoginPacket’s clientData JWT body, which is configured to warn on unexpected properties rather than

How CVE-2026-40347 Works The vulnerability exists in python-multipart, a streaming multipart parser for Python used in many web frameworks to

How the mentioned CVE works (technical breakdown) The vulnerability lies in src/API/UserController.php::updateUserPreference. When a PATCH request hits /api/users/{id}/preferences, the endpoint

How the mentioned CVE works: The vulnerability stems from a panic occurring during sequential element deallocation in thin_vec’s `IntoIter::drop` and

The root cause of this vulnerability is a logic inversion in the OIDC client’s caching mechanism. Specifically, when checking if

The vulnerability arises because the Velbus asset import endpoint does not disable Document Type Definition (DTD) processing or external entity

How the Mentioned CVE Works The vulnerability stems from a flaw in how OAuth2 Proxy processes URL fragments () within

The vulnerability arises from the absence of input validation on the `/Size` field in a cross‑reference (xref) stream and the

CVE-2026-40575 is a critical authentication bypass vulnerability affecting OAuth2 Proxy. The flaw exists in how the proxy handles the `X-Forwarded-Uri`

The `escapeForHtml()` function in assets/js/plugins/KimaiEscape.js, introduced in commit `89bfa82c` (2959) to patch a previous XSS vulnerability, only escapes the <,

How the mentioned CVE works (Server-Side Request Forgery): The vulnerability exists in two NocoBase plugins: `plugin-workflow-request` and plugin-action-custom-request. Both make

The vulnerability stems from improper validation of email claims when the `email_domain` enforcement feature is active. OAuth2 Proxy, when configured

The vulnerability stems from Thymeleaf’s expression preprocessing feature, which evaluates expressions inside `__${…}__` blocks before the main template is processed.

The `/api/auth/login` endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application’s

The NuGet client previously relied only on package signature validation to ensure integrity. However, an attacker could craft a malicious

The vulnerability exists in the `EncryptedXml` class within the `System.Security.Cryptography.Xml` namespace. It stems from unsafe handling of XML transforms during

How CVE-2025-68437 Works The vulnerability exists in the GraphQL `save__Asset` mutation within Craft CMS. The application is intended to fetch

The vulnerability arises in ImageMagick’s morphology processing, which applies a kernel (structuring element) to an image to alter its shape

The CVE-2026-33500 vulnerability arises from an incomplete fix for XSS in AVideo’s `ParsedownSafeWithLinks` class. This class extends the base Parsedown

How the CVE Works: The vulnerability exists in frp’s HTTP vhost routing when `routeByHTTPUser` is enabled. In proxy-style requests using

The vulnerability stems from an insecure handling of the `-define magnify:method` parameter. When an unrecognized value is supplied, the magnify

How the mentioned CVEs work: OpenTofu relies on Go’s standard library for TLS certificate verification (crypto/x509, crypto/tls) and tar archive

How the mentioned CVE works: The vulnerability resides in `fio_json_parser.h` within the numeral handling block (lines 434-468). When parsing a

How the mentioned vulnerability works (CVE-less but real): The Novu platform uses an HTML sanitizer to filter user-supplied email content.

The vulnerability exists because the path traversal fix in commit `2375eb5e0` only checks the URL path component (via parse_url($url, PHP_URL_PATH))

How CVE-2026-2332 Works The vulnerability stems from a critical deviation in how Eclipse Jetty parses HTTP/1.1 chunked transfer encoding, specifically

How CVE-2026-32178 Works A remote attacker could exploit a parsing flaw in the System.Net.Mail component, specifically within the MailAddress functionality.

How the CVE works: The vulnerability exists in `AppController::actionResourceJs()` endpoint /resource-js. This endpoint proxies remote JavaScript resources without authentication. The

How the CVE Works: This vulnerability stems from pyLoad caching a user’s role and permissions in the session at login.

How the CVE Works: The vulnerability is a stack buffer overflow in ImageMagick’s MNG encoder when processing a specially crafted

The vulnerability exists in MinIO’s handling of STREAMING-UNSIGNED-PAYLOAD-TRAILER requests. When processing PutObject or PutObjectPart calls, the function newUnsignedV4ChunkedReader receives a

This vulnerability resides in the PNG encoder’s MNG image writing routine. When `WritePNGImage()` within `coders/png.c` processes a Multiple-image Network Graphics

This vulnerability, affecting Kiota versions prior to 1.31.1, is a code-generation literal injection issue present in multiple writer sinks. These

The vulnerability resides in System.Security.Cryptography.Xml, specifically in how the `EncryptedXml` class (or the underlying XmlDecryptionTransform) processes XML data during decryption

How the mentioned CVE works: The vulnerability exists in AVideo’s plugin/Live/test.php endpoint. An incomplete fix added escapeshellarg() only for the

The vulnerability exists within the FTXT encoder of ImageMagick. The encoder fails to perform a boundary check when parsing the

The advisory addresses a collection of static code analysis warnings discovered within the DotNetNuke.Core codebase. These warnings are not a

Technical Analysis: How CVE-2023-0227 Works CVE-2023-0227 is an Insufficient Session Expiration vulnerability affecting pyload, an open-source download manager written in

How CVE-2026-0414 works: The vulnerability exists in October CMS backend editor settings, specifically the “Markup Classes” fields (paragraph styles, inline

How the mentioned CVE works (around 20 lines): The vulnerability exists in free5GC’s UDR service handling the GET endpoint /nudr-dr/v2/application-data/influenceData/{influenceId}/{subscriptionId}.

The vulnerability resides in the free5GC UDR’s handling of HTTP GET requests to the `/nudr-dr/v2/application-data/influenceData/subs-to-notify` endpoint. The function `HandleApplicationDataInfluenceDataSubsToNotifyGet` in

CVE-2025-49706 is an improper authentication vulnerability (CWE-287) in Microsoft SharePoint Server’s ToolPane endpoint. It allows an unauthorized attacker to perform

The `-sample` operation in ImageMagick is used to scale images by sampling pixels. A flaw exists in the logic that

A remote attacker exploits an off-by-one error when processing a specially crafted malicious MSL (Magick Scripting Language) file. The vulnerability

The vulnerability exists in mitmproxy versions 12.2.1 and below when the built-in LDAP proxy authentication is enabled via the `proxyauth`

The vulnerability (CVE not assigned in ) arises from improper path validation in free5GC’s UDR service. The endpoint `PUT /nudr-dr/v2/application-data/influenceData/{influenceId}/{subscriptionId}`

CVE-2026-40169 is a moderate-severity heap buffer overflow vulnerability in ImageMagick versions prior to 7.1.2-19. The flaw, identified as a heap-based