The `set_config_value()` API method (decorated with @permission(Perms.SETTINGS)) gates security‑sensitive options behind the `ADMIN_ONLY_CORE_OPTIONS` allowlist. The entry `(“general”, “ssl_verify”)` is missing
The vulnerability resides in the `DiscoverKeys` function within the `pkg/apk/apk/implementation.go` file. The core issue is an unchecked type assertion on
How the mentioned CVE works (missing authorization in Kirby CMS): 1. Kirby CMS uses user roles and permissions defined in
The vulnerability arises because Gotenberg blocks certain ExifTool tag names (like FileName, Directory) via an exact string match, but ExifTool
The vulnerability resides in the ModuleResourcesServlet. The getFile() method constructs a filesystem path from user-controlled input without performing path boundary
The vulnerability arises due to insufficient validation in Incus’s backup restore subsystem. When importing a backup archive, the `backup.GetInfo()` function
The vulnerability resides in ConceptReferenceRangeUtility.evaluateCriteria(), which evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The `VelocityEngine`
The vulnerability stems from missing nil-pointer validation in Incus’s custom volume backup import logic. When an authenticated user imports a
How CVE-2026-33743 Works Incus parses YAML files from user‑provided image and backup tarballs without any size restrictions. The functions `getImageMetadata`
The vulnerability stems from a missing nil-pointer check in the storage bucket import logic. An authenticated attacker can supply a
The vulnerability stems from a flawed bounds check inside the Incus backup‑restore and migration logic. When processing a backup archive,
The vulnerability arises from an inconsistency in how Quarkus handles HTTP matrix parameters (semicolons). The security layer performs authorization checks
How the CVE Works (approx. 20 lines): The vulnerability resides in the Kata Agent’s `CopyFile` API, specifically in how the
How the CVE works (approx. 20 lines): The vulnerability exists in Incus’s S3 bucket restore functionality, specifically in `TransferManager.UploadAllFiles` (file
How the mentioned CVE works: Traefik v3.6.13 errors middleware copies full original request headers including Authorization and Cookie to a
The vulnerability arises from missing authorization checks in Kirby CMS versions prior to 4.9.0 and 5.4.0. Authenticated Panel users with
How the CVE works: The OVN client in Incus disables Go’s default TLS server verification (InsecureSkipVerify: true) and replaces it
How CVE-2023-29017 Works: The vulnerability resides in vm2’s `__lookupGetter__` method, which switches between host and sandbox contexts when passed across
The vulnerability, dubbed “Copy Fail”, stems from the `algif_aead` component of the Linux kernel’s cryptographic subsystem mishandling memory operations when
The vulnerability resides in the help extension of Jupyter Notebook (version 7.x) and JupyterLab (version 4.x), specifically its command linker
The vulnerability arises from improper input validation (CWE-20) in the PrestaShop ps_checkout module. Attackers can send crafted HTTP requests containing
How the CVE works: The vulnerability is an incorrect allowlist enforcement caused by an off-by-one error in the suffixtrie implementation.
The vulnerability in CVE-2024-38821 resides in CKAN’s `datastore_search_sql` action function, which allows authenticated users to execute raw SQL queries against
The vulnerability resides in CKAN’s `datastore_search_sql` action function, which allows users to execute raw SQL queries against the DataStore PostgreSQL
The vulnerability exists in Gotenberg versions up to 8.29.1, specifically the default Docker image. The core issue is the `FilterDeadline`
How the mentioned CVE works: The vulnerability stems from missing authorization checks in Kirby CMS versions prior to 4.9.0 and
The vulnerability exists in the process manager of pygeoapi versions 0.23.0 through 0.23.2. When a user submits a job to
How the Mentioned CVE Works The vulnerability stems from a logic error in netfoil’s optional seccomp sandboxing feature. The `–filter-system-calls`
The vulnerability exists because four GET endpoints under `/api/templates` in Arcane’s Huma backend are registered without any `Security` requirement. In
How the mentioned CVE works (approx. 20 lines): The vulnerability exists in the Patreon OAuth provider of the go-pkgz/auth library
The vulnerability exists in the SDK embedder path (N8NDocumentationMCPServer constructor, getN8nApiClient(), and validateInstanceContext()). The synchronous URL validator `SSRFProtection.validateUrlSync()` lacks IPv6
The vulnerability stems from improper session handling in the cpsrvd daemon. Before a user is authenticated, the server writes a
How the mentioned CVE works: The `getResourcesHandler` in i18next-http-middleware versions below 3.9.3 forwards user-supplied `lng` and `ns` parameters directly into
How CVE-2026-41654 works: An authenticated attacker with `project.add` permission (the default on Weblate SaaS and for any user with an
How CVE-2026-42351 Works The vulnerability exists in pygeoapi’s STAC FileSystemProvider plugin, which handles directory traversal for STAC collection resources. The
The `BetaLocalFilesystemMemoryTool` in the Anthropic TypeScript SDK creates memory files and directories using Node.js default modes (0o666 for files, `0o777`
This flaw in the OTLP exporter’s disk retry mechanism allows local users to inject, read, or exhaust telemetry blobs on
How the mentioned CVE works (technical details): The vulnerability exists in ydb-go-sdk’s table service client when using `options.WithCommit()` on the
The vulnerability exists in the Contrast CLI’s policy generation for Kata agent, specifically in the CopyFile verification routine. A malicious
The vulnerability resides in how Sentry handles SAML SSO responses. When a user authenticates via a SAML Identity Provider (IdP),
How the mentioned CVE works: The vulnerability exists in Clerk’s authorization predicates (has(), auth.protect()) across @clerk/shared, @clerk/nextjs, @clerk/backend, and related
The CVE-2026-27018 vulnerability exploits a case-sensitive regular expression used in Gotenberg’s default private-IP deny-lists for the `–webhook-deny-list` and `–api-download-from-deny-list` parameters.
How CVE works: The vulnerability exists in Hickory DNS experimental hickory-recursor crate’s DnsLru cache. The cache stores DNS response records
The vulnerability exists in Gotenberg’s PDF metadata write endpoint (v8.30.1). The fix introduced in commit 405f106 added a regex `safeKeyPattern`
How the mentioned CVE works: The vulnerability exists in ColumnAndRowAttributes::readRowAttributes() at line 216 (src/PhpSpreadsheet/Reader/Xlsx/ColumnAndRowAttributes.php). The code casts the XML attribute
🔬 How the Vulnerability Works The core issue is how `PhpSpreadsheet` validates file paths supplied to IOFactory::load(). The library uses
How the mentioned vulnerability works (CVE-like issue): The SpreadsheetML XML reader (Reader\Xml) fails to validate the `ss:Index` attribute on “
The vulnerability (CVE-2026-40182) resides in the OpenTelemetry dotnet SDK’s OTLP HTTP exporter (OpenTelemetry.Exporter.OpenTelemetryProtocol). When the exporter sends telemetry data to
The vulnerability exists in the `AzureVmMetaDataRequestor` class of the OpenTelemetry.Resources.Azure library. This class makes HTTP GET requests to the Azure
How the mentioned CVE works: The vulnerability exists in the beets web UI plugin due to improper handling of metadata
This vulnerability resides in the Zipkin exporter component of the OpenTelemetry .NET SDK, which is used to send telemetry data
How the vulnerability works (CVE-less but follows ) The flaw exists in CoreDNS DoH GET handler at plugin/pkg/doh/doh.go. `RequestToMsg()` calls
CVE-2026-32202 is a protection mechanism failure in Windows Shell that stems from an incomplete patch for CVE-2026-21510 (a higher‑severity Windows
How the mentioned CVE works: The tsig plugin in CoreDNS decides whether an incoming TSIG was valid by using w.TsigStatus()
How CVE-2025-47950 (incomplete fix regression) works: The CoreDNS DoQ server uses a global worker pool (streamProcessPool) to limit concurrent stream
How CVE-2026-40296 Works: The vulnerability exists in the HTML Writer component of PhpSpreadsheet. It allows bypassing HTML escaping using custom
How the CVE Works This flaw resides in the user update logic of the `EditUser` controller. When a user submits
The vulnerability exists in the default cache key generator of the Fiber web framework’s cache middleware (github.com/gofiber/fiber/v3/middleware/cache). By default, the
How the CVE Works (Technical Details): The vulnerability stems from incomplete TSIG verification in CoreDNS transports. For gRPC and QUIC,
The vulnerability exists in ConnectWise ScreenConnect versions 23.9.7 and earlier due to improper sanitization of user-supplied input in file path
How CVE-2026-33489 Works This vulnerability lies in CoreDNS’s `transfer` plugin, which handles DNS zone transfers (AXFR/IXFR). When both a parent
The vulnerability resides in the HTML writer’s logic within `Writer/Html.php` at approximately line 1592. In this function, the code conditionally
How the mentioned CVE works: The vulnerability exists in the OpenClaw npm package versions below 2026.4.20. The Control UI’s “assistant-media”
The vulnerability lies in how GitPython validates multi_options before passing them to the git clone command. The `_clone()` method first
The vulnerability exists because the workspace `.env` loading mechanism failed to adequately reserve the `OPENCLAW_` runtime-control namespace. In vulnerable versions
How the CVE works: The vulnerability exists because GORM’s soft-delete scope does not apply to raw JOIN clauses. When a
The vulnerability resides in zrok’s WebDAV drive backend, specifically in the `davServer.Dir` implementation. While the backend correctly sanitizes path traversal
The vulnerability stems from a bypass in GitPython’s unsafe-option filtering. GitPython blocks dangerous Git command-line flags such as `–upload-pack` and
The vulnerability stems from improper authorization in OpenClaw’s paired-device pairing management component. In affected versions (< 2026.4.20), a session from
This CVE stems from a logging flaw when `n8n-mcp` runs in HTTP transport mode. An authenticated MCP `tools/call` request has
How the vulnerability works The vulnerability resides in the note-mark backend’s password verification logic. When a user is created via
How the mentioned CVE works (technical details): The vulnerability exists in OpenClaw’s tool‑policy pipeline when bundled MCP (Model Context Protocol)
How the mentioned CVE works: The vulnerability exists in OpenClaw npm package versions 2026.4.5 through 2026.4.19. An attacker who controls
The vulnerability exists in OpenClaw npm package versions before 2026.4.20 when handling Feishu (Lark) card-action callbacks. When a user in
The vulnerability exists in OpenClaw’s QQBot integration, specifically in the direct‑upload media path for `uploadC2CMedia` and `uploadGroupMedia` functions. When a
The vulnerability (no official CVE ID, but tracked as openclaw SSRF bypass) works as follows: OpenClaw allows browser profile creation
The vulnerability exists in how OpenClaw processes hook mapping templates that render session keys. When `hooks.allowRequestSessionKey` is disabled, the system
The vulnerability (CVE-2024-42459) exists in Cilium’s debugging tool cilium-bugtool. When Cilium is deployed with WireGuard Transparent Encryption for node-to-node communication,
Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot‑segments according to RFC 3986,
The vulnerability arises from a logical inconsistency in how Heimdall processes HTTP requests. According to the HTTP standard, hostnames are
The vulnerability exists in `github.com/electerm/electerm/npm/install.js` at line 130. The `runLinux()` function fetches remote release metadata (e.g., version string or release
The CVE-2025-54881 vulnerability resides in the Mermaid diagramming library, which Excalidraw depends on for rendering Mermaid diagrams. In Mermaid versions
The vulnerability exists in the forEach mutation handler of Kyverno’s legacy engine. In pkg/engine/mutate/mutation.go, the `ForEach` function performs a bare
The `wlc` command‑line client supports an optional `–format html` output mode designed to render translation data as a human‑readable HTML
The vulnerability stems from a logic flaw in GitVerify’s `requireSignedTags` functionality, which is enabled by default. The core issue is
The vulnerability exists in Traefik’s BasicAuth middleware. When a submitted username exists, the middleware performs a bcrypt password comparison taking
The vulnerability is an authorization bypass in Kirby CMS that allows authenticated users to override permission settings when creating pages,
How the vulnerability works: Traefik’s Kubernetes CRD provider enforces namespace isolation via providers.kubernetesCRD.allowCrossNamespace=false. Direct middleware references from `IngressRoute.routes[].middlewares[]` are validated
The vulnerability exists in the backend user settings module (SetupModuleController). In TYPO3 CMS version 14.2.0, this module incorrectly merged sensitive
How the mentioned CVE works (around 20 lines): The vulnerability resides in Traefik’s StripPrefixRegex middleware. When handling a request, the
How the mentioned CVE works The vulnerability chains two flaws in Traefik’s request handling. First, Traefik sanitizes only canonical forwarded
How the mentioned CVE works: The vulnerability exists in a database query used during proxy API key checks. The proxy
CVE-2026-41492: Unauthenticated token leakage through `/debug/vars`. Vulnerable Dgraph Alpha endpoints expose process command-line arguments. The `–security token=…` flag supplies the
How the CVE works: The vulnerability stems from incorrect use of Symfony’s ` ` attribute in Team API endpoints. Instead
The core of this vulnerability lies in the `sub_42232C` function within the router’s firmware. The `snprintf` function improperly copies an
The vulnerability stems from an implicit trust in length values read from serialized data streams across multiple zserio runtime implementations.
How the mentioned CVE works: The vulnerability resides in the `action_class` method inside app/controllers/avo/actions_controller.rb. The controller searches for an action
The vulnerability exists in SimpleHelp RMM (Remote Monitoring and Management) versions 5.5.7 and earlier. An authenticated attacker with only “Technician”
How the Vulnerability Works The `bit_string_flags()` function in `src/der.rs` extracts named-bit BIT STRINGs (KeyUsage, ReasonFlags, etc.) and validates padding bits.
The vulnerability stems from improper path sanitization during ZIP archive extraction. An authenticated admin user can upload a malicious ZIP
