漏洞公告

ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js

ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

nimiq-primitives: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof

nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-length keys

Pheditor has an authenticated terminal command whitelist bypass

MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode

Diesel has possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database`

Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock

Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header

Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit