Author name: UNDERCODE

How the mentioned CVE works: The vulnerability exists in `SseStream._transform()` within @nestjs/core. This method handles Server-Sent Events (SSE) streaming by

This vulnerability, similar to CVE-2020-15157 in containerd, allows credential exfiltration from Docker Registry’s pull-through cache. When configured as a pull-through

How the mentioned CVE works: The vulnerability resides in `ModalFormResponsePacket` handling. When a player sends a form response, the server

The vulnerability works due to a logical flaw in the `_validate_path()` method. The function first calls `os.path.normpath()` on the user-supplied

The vulnerability arises because when an entity dies, it is flagged for despawn but remains in the World’s entity table,

The vulnerability exists in Strawberry GraphQL versions ≤0.312.3 due to improper handshake validation in the legacy `graphql-ws` WebSocket subprotocol handler.

How the CVE Works: The vulnerability resides in the System Settings – Company Information panel where administrative configuration fields are

This vulnerability stems from the WebSocket subscription handlers in Strawberry GraphQL failing to enforce any limits on active subscriptions per

The vulnerability resides in how the Vite dev server processes URL query parameters. Normally, the `@fs` mechanism restricts access to

How the mentioned CVE works (Zip Slip in PraisonAI templates installation): The vulnerability exists because the CLI extracts untrusted ZIP

How CVE-2025-30231 works: The Vite dev server exposes a WebSocket for Hot Module Replacement (HMR). Normally, HTTP requests to `/@fs/`

How CVE-2025-XXXXX Works The vulnerability exists in how Vite’s development server handles requests for `.map` (source map) files of optimized

The vulnerability stems from the use of `fmt.Sprintf` to construct CQL (Cassandra Query Language) queries across all 66+ database functions

How the mentioned CVE works (approx. 20 lines): The vulnerability exists in PraisonAI’s recipe registry publish endpoint. When a client

The vulnerability stems from improper access control in FortiClientEMS versions 7.4.5 through 7.4.6. An unauthenticated attacker can send crafted HTTP/HTTPS

How the mentioned vulnerability works (CVE not assigned, but issue exists): The PocketMine-MP server incorrectly trusts `ActorEventPacket` sent by vanilla

The vulnerability stems from the unsafe extraction of tar archives during the recipe pull process. The `LocalRegistry.pull()` and `HttpRegistry.pull()` methods

The vulnerability exists because TrueConf Client downloads its application update code from a remote server without performing any cryptographic verification

How the mentioned CVE works: The vulnerability resides in Directus file management API endpoints `POST /files` and PATCH /files/{id}. The

The vulnerability arises when aggregate functions like `min` or `max` are applied to fields flagged with the `conceal` special type.

How the CVE works: The vulnerability exists in the rendezvous server’s pagination cookie storage. The server maintains a `HashMap` to

The vulnerability is a classic case of a hardcoded cryptographic secret, specifically a JSON Web Token (JWT) signing secret. It

The vulnerability exists in the `check.ffmpeg.json.php` endpoint, which is part of the AVideo platform’s API. This endpoint is designed to

How the CVE Works Directus uses an IP deny-list to block requests to internal or private network ranges. However, its

The vulnerability arises from a parameter reuse flaw in OpenClaw’s Gemini OAuth flow. Prior to version 2026.4.2, the application incorrectly

The BlockonomicsYPT plugin for AVideo includes an endpoint at `plugin/BlockonomicsYPT/check.php` that processes AJAX polling requests for payment order data. This

How the CVE Works (Zip Slip Path Traversal): The vulnerability exists in the `ExtractZip` function of coder/code-marketplace versions ≤ v2.4.1【8†L3-L5】.

The vulnerability resides in Directus’ GraphQL endpoints `/graphql` and /graphql/system, which failed to deduplicate resolver invocations within a single request.

How the mentioned CVE works: The vulnerability stems from the absence of the `Cross-Origin-Opener-Policy` (COOP) HTTP header on Directus’s Single

The vulnerability exists in the `install/test.php` diagnostic script of AVideo platform. The script was intended to run only from the

How CVE-2026-33992 Works (Original Vulnerability & Bypass) The original CVE-2026-33992 allowed SSRF because pyload did not validate IP addresses of

How CVE-2026-35405 works The libp2p-rendezvous server lacks per-peer namespace registration limits. A malicious peer can register an arbitrary number of

How CVE-2023-43838 works: The vulnerability stems from inconsistent application of ADMIN_ONLY_OPTIONS. In pyload core, a set of security-critical configuration options

The vulnerability resides in the TUS resumable upload endpoint (/files/tus). The TUS controller performs only collection-level authorization checks, verifying the

Directus versions before 11.16.1 fail to enforce the `GRAPHQL_INTROSPECTION=false` setting on the `/graphql/system` endpoint. When `GRAPHQL_INTROSPECTION=false` is configured, the platform

How the mentioned CVE works (around 20 lines): The vulnerability resides in `plugin/CloneSite/client.log.php` which includes a sensitive log file without

How CVE-2024-39895 Works The GraphQL specification allows a single query to request the same field multiple times using aliases, with

How CVE-2026-33509 works: A non-admin user with SETTINGS and ADD permissions changes the storage_folder config option to the Flask filesystem

The vulnerability exists because web3.py enables CCIP Read (EIP-3668) by default globally (global_ccip_read_enabled = True). When a smart contract reverts

The vulnerability is an unvalidated open redirect within the Directus Admin App’s Two-Factor Authentication (2FA) setup flow. It is triggered

How CVE-2018-19790 Works The vulnerability arises from a parser differential between Symfony’s server-side URL validation and how modern web browsers

The vulnerability exists because the YPTSocket plugin constructs incoming call notifications using the jQuery Toast Plugin, which inserts the caller’s

The vulnerability exists because the poetry-plugin-tweak-dependencies-version plugin pins a specific vulnerable version of the `requests` library (likely 2.31.0 or earlier)

How the mentioned CVE works The vulnerability resides in objects/pluginSwitch.json.php, an endpoint intended for administrators to enable or disable plugins.

How the mentioned CVE works: CVE-2022-40896 is a vulnerability residing in Pygments, a popular syntax highlighter. The core issue lies

How the Mentioned CVE Works The vulnerability exists in /objects/emailAllUsers.json.php, an endpoint intended for administrators to send mass emails. The

How the Mentioned CVE Works The vulnerability resides in the session cookie handling mechanism of the Auth0 PHP SDK prior

The vulnerability arises from improper access control in the Tool Valves endpoint of Open WebUI. Tools enable LLMs to call

The vulnerability stems from three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) storing PKCE verifiers and access tokens as mutable struct

How the CVE Works: The vulnerability chain combines a pre‑authenticated SQL injection (GHSA-2fr7-cc4f-wh98) with an unauthenticated insecure deserialization in oauth2.php.

The vulnerability exists in how aiohttp handles HTTP/1.1 trailer headers when chunked transfer encoding is used. By default, the library

How the mentioned CVE works The vulnerability exists in multiple AJAX select handlers due to unsafe concatenation of the `options

The vulnerability is a use-after-free condition within the Dawn graphics library, the WebGPU implementation in Google Chrome. When a crafted

The vulnerability stems from insufficient input validation in the password recovery flow. When a user initiates a password reset via

The vulnerability arises from a logic flaw in OpenClaw’s sender policy resolution when only a route‑level group allowlist is configured.

The vulnerability exists in `Ash.Type.Module.cast_input/2` (lines 105–113) and `cast_stored/2` (line 141) of the Ash framework. When a binary string starting

The vulnerability arises from improper authorization scoping within the Gateway’s method handlers. Specifically, the `chat.send` method reuses command authorization logic

How the Mentioned CVE Works The CVE describes an unauthenticated stored cross-site scripting (XSS) vulnerability in YesWiki’s BazaR extension. The

How the mentioned CVE works The unauthenticated `/api/icon/getDynamicIcon` endpoint inserts user‑controlled `content` directly into an SVG “ element using `fmt.Sprintf`

The vulnerability arises from improper handling of the CDATA terminator `]]>` within CDATA sections during XML serialization. When an attacker-controlled

The vulnerabilities are reflected cross-site scripting (XSS) flaws present in both authenticated and unauthenticated areas of YesWiki. The core issue

The vulnerability resides in the node pairing approval flow. In OpenClaw, a node must be approved by an operator before

The vulnerability stems from a logic regression in `escapeNodeAttributeValues` within kernel/filesys/tree.go. Previously, the code converted `node.KramdownIAL` using parse.IAL2Map(), which unescaped

How the CVE Works The vulnerability resides in the host execution environment’s sanitization logic for environment variables. When an approved

The vulnerability exists in the Nextcloud Talk webhook handler, specifically within the signature verification logic. When an external service sends

The vulnerability arises from OpenClaw’s startup sequence, which loads a `.env` file from the current working directory (CWD) before it

How the CVE Works The vulnerability resides in Parse Server’s LiveQuery feature, which allows real-time subscriptions to queries. When a

The vulnerability arises from a truthiness‑based guard in Parse Server’s session update endpoint. When an authenticated user sends a PUT

The vulnerability is a Stored DOM-based Cross-Site Scripting (XSS) issue residing in the group and role management functionalities. The application

The vulnerability exists within OpenClaw’s SSRF (Server-Side Request Forgery) protection mechanism, specifically in the IP address classification logic within `src/shared/net/ip.ts`

The vulnerability arises from improper validation of provenance fields in the `chat.send` WebSocket method. When an operator client establishes a

How the mentioned CVE works The vulnerability resides in the media route handlers of `@tinacms/cli` (specifically dev mode). A lexical

The vulnerability arises from a logic gap in OpenClaw’s Discord extension. When a user interacts with a Discord component (e.g.,

How the mentioned CVE works: The application’s Methods Management feature accepts user-controlled input across multiple fields (Page Name, Description, Controller,

How the Vulnerability Works The vulnerability exists in `@tinacms/graphql` due to a realpath gap in its filesystem containment checks. The

The vulnerability arises from the unsafe use of Python’s `eval()` function within the `torchgeo.models.get_weight()` API and related trainer modules in

The vulnerability stems from an ineffective symlink check in ONNX’s external data loading routine. When a model references external data

The vulnerability resides in baserCMS’s tag creation feature, specifically in how user‑supplied tag names are processed before being rendered in

The vulnerability exists in the SciTokens Enforcer library (versions prior to the fix) where the `_check_scope` and `_scope_path_matches` methods fail

The vulnerability exists because the Sliver MCP server, which runs inside the Sliver client, binds an unauthenticated HTTP and SSE

The vulnerability exists because the public API endpoint for mail submissions does not enforce the same acceptance checks as the

The vulnerability resides in the update functionality of baserCMS versions up to 5.2.2. When an authenticated administrator triggers a system

The vulnerability resides in the blog post functionality of baserCMS versions 5.2.1 and earlier. When a user with blog editing

The vulnerability exists in Nautobot versions prior to 2.4.30 and 3.0.10 due to improper enforcement of Django password validators when

The SQL injection vulnerability in baserCMS exists within the blog post functionality due to improper handling of user-supplied input when

The vulnerability resides in the `_build_url()` method of FastMCP’s `RequestDirector` class, used to construct HTTP requests for OpenAPI‑defined endpoints. When

How the CVE Works The vulnerability stems from an email validation bypass in PHP’s `FILTER_VALIDATE_EMAIL` filter. The function accepts email

How the mentioned CVE works The vulnerability resides in the theme file management API endpoint /baser/api/admin/bc-theme-file/theme_files/add.json. The function `getFullpath()` in

The vulnerability exists in the SciTokens Enforcer class, specifically within the `_validate_scp` and `_validate_scope` methods (src/scitokens/scitokens.py). These methods are responsible

The vulnerability stems from improper sanitization of user-supplied input during the installation process of baserCMS versions 5.2.2 and earlier. When

The vulnerability exists in the `KeyCache` class within src/scitokens/utils/keycache.py, where multiple database operations use Python’s `str.format()` to construct SQL queries.

The vulnerability stems from Cloudreve’s use of the `math/rand` package, a weak pseudo‑random number generator (PRNG), seeded with `time.Now().UnixNano()` during

The vulnerability exists in the core update functionality where an authenticated administrator can trigger Remote Code Execution (RCE). The flaw

The vulnerability arises from how `fastmcp install` handles server names containing shell metacharacters (such as &) on Windows. When a

The vulnerability resides in the application’s restore functionality, which allows authenticated administrative users to upload a `.zip` archive for site

How the mentioned CVE works The vulnerability exists in the FastMCP OAuthProxy’s `_handle_idp_callback` function, which fails to validate that the

The vulnerability resides in the `categories.json.php` API endpoint, which fails to enforce user group–based restrictions when listing categories. In the

How the CVE Works This vulnerability exploits an authorization inconsistency between two API surfaces in OpenClaw. The WebSocket RPC control

How the Mentioned CVE Works The vulnerability exists in the `verifyTokenSocket()` function located at plugin/YPTSocket/functions.php. WebSocket tokens are generated with

How the Mentioned CVE Works The vulnerability stems from a flaw in Sulu’s permission handling mechanism for subentities endpoints. When