漏洞公告

Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers

Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)

Scriban: array * int (ScriptArray<T>.TryEvaluate) bypasses LoopLimit — incomplete fix for GHSA-c875-h985-hvrc, missed sibling of GHSA-24c8-4792-22hx

nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction

WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs

CakePHP: View::element() is missing a path containment check

joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server

PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling

Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system

Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container

Flawfinder output manipulation via untrusted filenames and source text

python-socketio: Binary attachment accumulation can cause denial of service

python-engineio has unbound thread allocation that can cause denial of service

semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin

python-engineio has possible denial of service due to maximum payload size sometimes not being enforced

LinkifyIt#match scan loop has quadratic algorithmic complexity

turso-cli persists Turso platform JWT with world-readable (0o644) file permissions

nono-py's policy JSON accepts unknown security fields

nono-py vulnerable to authorization bypass / policy confusion

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

nono-py has proxy-only network fallback bypass on older Linux kernels