漏洞公告

sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

Etherpad has stored XSS in HTML export via unescaped attribute-pool values

Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

uniget CLI has an EDITOR Command Injection

vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

sqlparse: Quadratic O(n²) DoS in group_comments

Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

New API: Integer overflow in quota billing yields negative charges (self-crediting)

New API: Admin can reset passkeys for same-level or higher-privileged users

New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation