漏洞公告

vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain

vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks

vm2 is Vulnerable to Sandbox Breakout Through Promise Species

vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter

vm2 has a Sandbox Escape issue

Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

Gotenberg has a Race Condition via Multipart `downloadFrom` Handling

Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes

Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix

Froxlor has an incomplete fix for CVE-2026-30932

Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path

Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement

GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands

HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint

OpenStack Neutron has an Incorrect Authorization issue

tuf has platform-dependent delegation path matching

Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives

Dulwich Vulnerable to Command Injection via Merge Driver Path