漏洞公告

Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver

Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers

Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI

node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

node-opcua missing nonce verification in UserNameIdentityToken authentication

next-video: Unauthenticated arbitrary file read via /api/video request handler

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Zoo Design Studio: Memory-corruption in memory handling of lib-kcl

Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service

stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address

NocoBase backup restore schema name allows command injection