网络安全雷达 Security Radar

[CISA KEV] CVE-2026-104935 — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Tue, 13 Oct 2026 00:00:00 GMT

在野利用 · EPSS 87% · 公开 PoC ×5 · 多源印证（长亭） — Ivanti Connect Secure: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

[长亭漏洞库] PHP 远程代码执行漏洞（php2shell，CVE-2026-109618/CVE-2026-109619）

Wed, 21 Oct 2026 00:00:00 GMT

Critical · EPSS 100% · 公开 PoC ×682 · 多源印证（资讯） · 关注厂商：apache — PHP 是一种广泛使用的开源服务器端脚本语言，通常以 PHP-FPM、CGI 或 Apache 模块（mod_php）方式部署，是 WordPress、Drupal、Laravel、Symfony、Magento 等主流框架与建站系统，以及大量 Web 应用、共享主机和控制面板的常见运行环境。 2026 年 10 月，长亭安全应急响应中心监测到 PHP Core 的 session 上传进度（session.upload_progress，rfc1867 回调）处理机制存在内存破坏缺陷，公开讨论中以 php2shell 指代该组漏洞，对应 CVE-2026-109618 与 CVE-2026-109619，官方评级均为 CVSS v4.0 9.2（严重）。攻击者可通过构造特制的 multipart/form-data 请求破坏 PHP 进程内存，进而可能导致远程代码执行。长亭已在实验

[CISA KEV] CVE-2026-110447 — Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Fri, 23 Oct 2026 00:00:00 GMT

在野利用 · EPSS 12% · 公开 PoC ×1 — Collabora Collabora Online – Built-in CODE Server: Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.

[CISA KEV] CVE-2026-96656 — Plex Media Server External Control of File Name or Path Vulnerability

Tue, 20 Oct 2026 00:00:00 GMT

在野利用 · 公开 PoC ×1 — Plex Media Server: Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

[CISA KEV] CVE-2026-96652 — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Tue, 20 Oct 2026 00:00:00 GMT

在野利用 · 公开 PoC ×6 — Plex Media Server: Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

[CISA KEV] CVE-2026-21589 — Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Thu, 15 Oct 2026 00:00:00 GMT

在野利用 · EPSS 99% · 公开 PoC ×13 — Atlassian Multiple Products: Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

[CISA KEV] CVE-2026-105134 — Ahsay AhsayCBS Command Injection Vulnerability

Wed, 14 Oct 2026 00:00:00 GMT

在野利用 · EPSS 86% · 公开 PoC ×1 — Ahsay AhsayCBS: Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

[CISA KEV] CVE-2026-105133 — Ahsay AhsayCBS Improper Authentication Vulnerability

Wed, 14 Oct 2026 00:00:00 GMT

在野利用 · EPSS 79% · 公开 PoC ×1 — Ahsay AhsayCBS: Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.

[CISA KEV] CVE-2015-5477 — ISC BIND Data Processing Errors Vulnerability

Thu, 08 Oct 2026 00:00:00 GMT

在野利用 · EPSS 100% · 公开 PoC ×7 — ISC BIND: ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

[CISA KEV] CVE-2026-102764 — BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

Fri, 16 Oct 2026 00:00:00 GMT

在野利用 · EPSS 20% · 公开 PoC ×3 — BeyondTrust Remote Support: BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.

[CISA KEV] CVE-2023-22894 — Strapi Cleartext Storage of Sensitive Information Vulnerability

Thu, 08 Oct 2026 00:00:00 GMT

在野利用 · 公开 PoC ×2 — Strapi Strapi: Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

[CISA KEV] CVE-2026-76519 — Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Wed, 14 Oct 2026 00:00:00 GMT

在野利用 · 公开 PoC ×1 — Cisco Secure Email Gateway: Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

[CISA KEV] CVE-2026-110936 — Siemens Software Center Uncontrolled Search Path Element Vulnerability

Tue, 20 Oct 2026 00:00:00 GMT

在野利用 · 公开 PoC ×1 — Siemens Software Center: Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

[CISA KEV] CVE-2026-0322 — Palo Alto Networks PAN-OS Code Injection Vulnerability

Wed, 14 Oct 2026 00:00:00 GMT

在野利用 · 公开 PoC ×1 — Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

[CISA KEV] CVE-2026-106931 — EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

Tue, 20 Oct 2026 00:00:00 GMT

在野利用 — EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

[CISA KEV] CVE-2026-96654 — Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Tue, 20 Oct 2026 00:00:00 GMT

在野利用 — Plex Media Server: Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.

[CISA KEV] CVE-2016-3081 — Apache Struts Command Injection Vulnerability

Thu, 08 Oct 2026 00:00:00 GMT

在野利用 · EPSS 97% — Apache Struts: Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

[CISA KEV] CVE-2026-96655 — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Tue, 20 Oct 2026 00:00:00 GMT

在野利用 — Plex Media Server: Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.

[CISA KEV] CVE-2026-96951 — Microsoft Windows Command Injection Vulnerability

Tue, 13 Oct 2026 00:00:00 GMT

在野利用 · EPSS 前 4.5% — Microsoft Windows: Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

[GitHub Advisory · pip / pillow] CVE-2026-112398 — Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

Fri, 23 Oct 2026 21:55:21 GMT

Critical · 公开 PoC ×1 · 关注厂商：linux、docker — ### Credits **Researcher**: Alex Bouffard (mixbo@pebwalker.com) ### Summary A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with `Image.open()`. The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional `olefile` dependency installed is reachable with no user interaction. In the PoC

[CISA KEV] CVE-2026-114625 — Arista VeloCloud Orchestrator SQL Injection Vulnerability

Fri, 23 Oct 2026 00:00:00 GMT

在野利用 — Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

[长亭漏洞库] Ivanti Connect Secure 未认证远程代码执行与提权漏洞链（CVE-2026-104935）

Tue, 13 Oct 2026 00:00:00 GMT

EPSS 87% · 公开 PoC ×5 · 多源印证（CISA KEV） — Ivanti Connect Secure 是一款远程接入（VPN）安全网关产品，用于为员工与外部用户提供加密的远程访问通道，并承担接入侧的身份认证职责，广泛部署在企业内网边界，作为访问内部业务系统的统一入口。 2026 年 10 月，长亭安全应急响应中心监测到 Ivanti Connect Secure 存在认证绕过与远程代码执行风险（CVE-2026-104935）。攻击者无需有效账号即可绕过身份认证，在设备上执行任意代码，并可进一步将权限提升至 root；公开信息显示相关漏洞链已被用于在野攻击，攻击活动主要围绕凭据窃取、目录服务信息收集、流量嗅探与日志清理展开。长亭安全应急响应中心已完成复现验证。截至通告发布，Ivanti 已针对 CVE-2026-104935 发布修复版本，权限提升组件将在后续版本中修复；建议使用受影响版本的用户尽快确认资产暴露面并完成升级。

[长亭漏洞库] Citrix NetScaler 命令注入漏洞（CVE-2026-88771）

Sun, 27 Sep 2026 00:00:00 GMT

Critical · EPSS 82% · 公开 PoC ×12 — Citrix NetScaler ADC 与 Citrix NetScaler Gateway 是面向企业网络的应用交付控制器和远程接入网关，主要用于负载均衡、SSL 卸载、身份认证和 VPN 远程访问，广泛部署于大型政企网络边缘，作为内部应用与远程办公的入口。2026 年 9 月，长亭安全应急响应中心监测到 Citrix NetScaler ADC 与 NetScaler Gateway 未授权命令注入漏洞（CVE-2026-88771）。攻击者无需登录即可通过网络请求触发该漏洞，可在设备上执行任意命令。截至通告发布，官方已发布修复版本，公开信息显示该漏洞已被在野利用，且相关利用代码已经公开。建议受影响用户立即升级至官方安全版本，并在升级前评估设备是否已被入侵。受影响版本：NetScaler ADC / NetScaler Gateway 14.1 低于 14.1-73.37、13.1

[长亭漏洞库] GitLab 未认证远程代码执行漏洞（CVE-2026-97229）

Tue, 13 Oct 2026 00:00:00 GMT

Critical · EPSS 18% · 公开 PoC ×2 — GitLab 是一体化 DevOps 平台，提供代码托管、代码审查、持续集成与持续交付（CI/CD）、制品管理等能力，广泛用于企业内部的软件研发与交付流程，支持自建部署（CE/EE）与云端托管（GitLab.com）等多种形态。 2026 年 10 月，长亭安全应急响应中心监测到 GitLab CE/EE 的 CI/CD 正则表达式编译器存在整数溢出风险（CVE-2026-97229）。攻击者可借助公开可访问的 CI/CD 配置校验入口，以不携带任何凭据的网络请求触发该缺陷，导致 GitLab 服务端进程以 git 账号身份执行任意命令，可能造成服务器被完全控制以及源码、CI/CD 凭据泄露。长亭安全应急响应中心已完成复现验证。截至通告发布，官方已发布修复版本，GitLab.com 已完成修复；建议自建 GitLab CE/EE 用户尽快确认版本并按官方指引升级。

[长亭漏洞库] Gitea diffpatch API 远程代码执行漏洞

Wed, 26 Aug 2026 00:00:00 GMT

Critical · EPSS 24% · 公开 PoC ×11 — Gitea 是一个开源、轻量级的自托管 Git 服务程序，通常用于企业或团队搭建代码托管、版本控制、代码评审与 CI/CD 协同平台，常见部署形态包括二进制服务、容器镜像、Bitnami 镜像和 MinimOS 等发行版包。该漏洞影响 1.17.0 至 1.27.0 之间的 Gitea 版本。根据 NVD 描述和 Gitea 官方安全公告，漏洞位于 diffpatch API 的补丁应用流程中：Gitea 在临时裸仓库中通过 git apply 处理攻击者可控的补丁内容，当同一个可执行补丁被重复提交时触发 add/add 冲突，Git 的三方合并回退逻辑会把受控文件检出到仓库的 hooks 目录，使 hooks/post-index-change 成为可执行 Git 钩子，并在后续写索引时被自动调用，从而以 Gitea 服务账户权限执行任意 shell 命令。攻击者只需具备普通仓库写权限即

[CISA KEV] CVE-2025-61624 — Fortinet Multiple Products Path Traversal Vulnerability

Fri, 16 Oct 2026 00:00:00 GMT

在野利用 — Fortinet Multiple Products: FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

[GitHub Advisory · composer / laravel/framework] CVE-2026-114509 — Laravel TokenGuard authentication bypass through non-string API credentials

Fri, 23 Oct 2026 21:50:27 GMT

Critical · 公开 PoC ×5 — Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. **Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected. ### Im

[长亭漏洞库] GitLab 路径遍历漏洞（CVE-2026-85706）

Sat, 12 Sep 2026 00:00:00 GMT

EPSS 97% · 公开 PoC ×13 — GitLab 是开源的 DevOps 平台，提供代码托管、持续集成与交付、缺陷跟踪等能力，广泛应用于企业自建代码仓库与软件交付流水线。2026 年 9 月 10 日，长亭安全应急响应中心监测到 GitLab 仓库提交记录 API 路径遍历漏洞（CVE-2026-85706）风险。攻击者无需登录，在目标实例存在可匿名访问的公开项目时，即可读取 GitLab 服务器上的任意文件，可能造成源代码、配置文件与凭证等敏感信息泄露。长亭安全应急响应中心已完成复现验证。截至通告发布，官方已发布修复版本，暂未发现公开利用代码。建议所有受影响的自建 GitLab 实例立即升级。

[长亭漏洞库] JFrog 权限绕过漏洞

Fri, 28 Aug 2026 00:00:00 GMT

EPSS 14% · 公开 PoC ×8 — JFrog 在默认配置下存在认证绕过漏洞（CVE-2026-82329，CVSS 9.8）。Access 组件将空白 join key 纳入可信集合，未认证攻击者可伪造 HS256 JWT，向无需登录的集群加入接口 POST /access/api/v1/registry/join 换取 scp=admin 的 SERVICE token，并进一步兑换 applied-permissions/admin 平台管理员令牌，从而完全接管应用。

[GitHub Advisory · npm / multer] CVE-2026-113872 — multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

Fri, 23 Oct 2026 22:08:22 GMT

公开 PoC ×1 — ### Impact When `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file's async `fileFilter` is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled `'error'` event, and the process exits. A single unauthen

[GitHub Advisory · rust / wasmtime] CVE-2026-115889 — Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Fri, 23 Oct 2026 22:02:20 GMT

Critical — ## Summary In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full `u32` inde

[GitHub Advisory · npm / happy-dom] CVE-2026-115895 — Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Fri, 23 Oct 2026 22:06:13 GMT

关注厂商：windows、docker — ## Summary The ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates `importName` in the local `export { ... }` handler, but the named impo

[长亭漏洞库] KubePi SSO 管理接口未授权致配置泄露与账户接管漏洞

Wed, 26 Aug 2026 00:00:00 GMT

关注厂商：kubernetes — KubePi 是流行的 Kubernetes 多集群管理面板。在 v2.0.0 之前的版本中，SSO（单点登录）管理模块被错误地挂载在公开路由上，导致未经认证的远程攻击者可直接访问配置读写及连通性测试接口。可能导致敏感信息泄露、数据篡改等严重后果，给系统安全性带来较大威胁。

[GitHub Advisory · npm / @azure/msal-node] CVE-2026-109461 — MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

Fri, 23 Oct 2026 22:16:44 GMT

关注厂商：microsoft — ### Impact Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow. ### Patches Version 7.1.0 and higher are patched. ### Workarounds Ensure you pass in only the auth_code to to acquireTokenByCode

[GitHub Advisory · go / github.com/labstack/echo/v4] Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Fri, 23 Oct 2026 20:49:37 GMT

Critical — ## Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only at Echo's routes. Exploitation

[GitHub Advisory · pip / filelock] CVE-2026-112940 — filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

Fri, 23 Oct 2026 21:59:08 GMT

关注厂商：windows、linux — `ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor (the number the kernel gives a process for an open file). It then connects SQLite to `/proc/self/fd/`, a Linux path that names the process's own open file `n`. SQLite turns that path back into a plain path and reopens it by name, following symlinks (a symlink is a file that points at another path). On every POSIX

[GitHub Advisory · pip / vllm] CVE-2026-114055 — vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)

Fri, 23 Oct 2026 20:58:36 GMT

## Summary API clients can supply arbitrary `mm_processor_kwargs` per request. vLLM forwards these values through the multimodal rendering and processing pipeline to Hugging Face and custom image/video processor constructors and calls. Resource-sensitive values such as image size, patch size, patch count, crop count, or frame count can therefore be controlled by a remote client. For processors that upscale inputs, a single request can force an allocation large enough to terminate the API serve

[GitHub Advisory · pip / pypdf] CVE-2026-115585 — pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

Fri, 23 Oct 2026 20:54:27 GMT

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams. ### Patches This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240). ### Notes This is a follow-up to https://github.com/py-pdf/pypdf/securi

[GitHub Advisory · pip / pypdf] CVE-2026-115580 — pypdf: Possible long runtimes for large xref table header limits

Fri, 23 Oct 2026 20:54:12 GMT

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table. ### Patches This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4239](https://github.com/py-pdf/pypdf/pull/4239).

[GitHub Advisory · pip / pypdf] CVE-2026-115572 — pypdf: Possible long runtimes for repeated references to the same missing object

Fri, 23 Oct 2026 20:55:15 GMT

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times. ### Patches This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240).

[GitHub Advisory · npm / electron] CVE-2026-115570 — Electron: Mitigation for compromised eMudhra intermediate certificates

Fri, 23 Oct 2026 20:53:41 GMT

### Impact A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app. Apps are only affected if they make TLS connections over a network an attacker can intercep

[GitHub Advisory · npm / body-parser] CVE-2026-111181 — body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

Fri, 23 Oct 2026 20:53:11 GMT

### Impact A single request can crash any application using `body-parser` with default options. When a request carries a `Content-Encoding` (for example `gzip`), `body-parser` pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is r

[GitHub Advisory · rust / gix] gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()

Fri, 23 Oct 2026 20:52:28 GMT

关注厂商：windows — ## Summary In the `gix` crate, `Cache::protect_options()` in `gix/src/config/cache/access.rs` reads the three filesystem path-protection settings (`core.protectHFS`, `core.protectNTFS`, and `gitoxide.core.protectWindows`) with the unfiltered `gix_config::File::boolean()` accessor instead of the trust-aware `boolean_filter()` accessor used by every other security-critical config read in the same file. When a repository is opened with reduced trust (an ownership mismatch, which maps `.git/config`

[GitHub Advisory · npm / undici] CVE-2026-109869 — undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

Fri, 23 Oct 2026 22:14:31 GMT

### Impact undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an

[GitHub Advisory · pip / virtualenv] CVE-2026-113718 — virtualenv: Xonsh activation literals depend on the script decoding codec

Fri, 23 Oct 2026 22:24:43 GMT

## Summary Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment. ## Affected area Xonsh reads a UTF-8 activation script using a legacy multibyte encoding such as GBK. Printable non-ASCII bytes can change how the reader recognizes an adjacent quote. The report concerns POSIX activation. It does not establish exposure through unrelated activators.

[GitHub Advisory · pip / virtualenv] CVE-2026-113723 — virtualenv: Bash prompt values can change meaning under older compatibility modes

Fri, 23 Oct 2026 22:21:57 GMT

## Summary Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. ## Affected area Bash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from newer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation. It does

[GitHub Advisory · npm / postal-mime] postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

Fri, 23 Oct 2026 21:54:36 GMT

### Impact Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, an

[GitHub Advisory · go / github.com/labstack/echo/v4] Echo: WebSocket proxy can retain connections and handlers after client disconnect

Fri, 23 Oct 2026 20:50:17 GMT

## Impact Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction ended. Rejected upgrade responses with HTTP keep-alive were one way to trigger this behavior. Repeated connections can accumulate resources and cause denial of service. The impact depends on the prox

[GitHub Advisory · go / github.com/labstack/echo/v4] Echo: Decompress permits unbounded gzip expansion in v4

Fri, 23 Oct 2026 20:49:49 GMT

## Impact Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, and repeated or concurrent requests could cause denial of service. The middleware is not enabled by default. A limit on the compressed request size alone does not bound the decompressed size. Applications that already app

[GitHub Advisory · go / github.com/labstack/echo/v4] Echo: BodyDump captures request and response bodies without size limits in v4

Fri, 23 Oct 2026 20:48:44 GMT

## Impact Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation. Repeated or concurrent requests can exhaust process memory and cause denial of se