最新漏洞情报100

Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Tina: Code injection via unescaped Git branch name in generated client source

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

Contao: Cross-site scripting in the comments bundle

Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

Vikunja: Unbounded CSV row cardinality permits API process termination

Vikunja: Unbounded nested task-filter recursion permits API process termination

Vikunja: Denial of service via decompression bomb in the data import

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

pyLoad: Api.set_user_permission never invalidates the target's session

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

pyLoad has an authentication bypass in API key validation (check_apikey cache)

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Hazelcast allows arbitrary member memory access by low-privileged client

Hazelcast has an authorization bypass in IMap Predicates API

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

PraisonAI: Shell command allowlist bypass via find -exec built-in action

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Handlebars: JavaScript Injection via Own Property Check Bypass

Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob

msgpack5: Truncated map32 headers throw an unexpected error

msgpack5: Many buffered values can exhaust the streaming decoder stack

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

PraisonAI: SkillTools Executes Scripts Without Path Containment Validation

PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

Citrix NetScaler ADC和NetScaler Gateway远程代码执行漏洞

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Ghost: Remote Code Execution via Bookmark Card Images

Ghost: Stored XSS via Embed Card Previews

Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Next.js has Server-Side Request Forgery in Image Optimization

Payload: SQL injection in SQLite/Postgres

Payload: Remote Code Execution through first-register

Payload has a tenant authorization bypass in Multi-Tenant Plugin

Payload external upload trust validation issue

Payload: Bypassed sanitization of user uploaded SVGs

Payload: Incomplete validation during the upload file lifecycle

Payload: Client uploads could overwrite S3 objects

Payload: Uploaded XML files could execute same-origin JavaScript

Payload Form Builder has an RCE issue

Payload: Unauthorized update to collection documents

Payload authentication token field handling issue