Executive Summary

FoxTerm Security Intel

October 29, 2026

Security Industry (3)

Qwenputer: A functioning, deterministic RISC-V CPU inside Qwen3.5

Kentucky man becomes the first humanist granted religious exemption from AI

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf) — ## Affected versions Verified on 4.0.2 (latest on npm) and on commit 07e0288 (the GHSA-xvq9-wjp8-hwqf fix). Earlier 3.x/4.x versions that allow `/` in

Vulnerability (79)

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

PHP2Shell, LiteLLM, GitLab: Find What You Need to Patch

PHP2Shell: Exploitation attempts and remediation trends

How fast can you actually patch Ruby?

Discovering and exploiting vulnerabilities in critical software with Claude

qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) — ## Summary `qs.stringify(obj, { arrayFormat: 'comma' })` throws an uncaught `TypeError: Cannot convert object to primitive value` when an array in `ob

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks — ### Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yieldin

Tornado: Open redirect in RedirectHandler via protocol-relative URLs — ### Summary `tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a template. Depending on where those su

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding — ### Summary Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold)

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass — ## Summary Crass's tokenizer didn't terminate a bad URL token at a `)` that followed an escaped backslash (`\\`). As a result, Crass consumed more inp

systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks — ### Summary On Windows, `[email protected]` builds a PowerShell command using the value passed to `services()`. The default sanitizer removes

Backstage catalog rules can be bypassed for URL locations using encoded path segments — ## Summary `@backstage/plugin-catalog-backend` matches URL-type locations against `catalog.rules` location patterns using the raw URL string submitted

Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it — ### Summary The main Electrum server the client connects to is trusted with mempool ("unconfirmed") transactions. This is documented [design](https://

knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion — ## ⚠️ Update (verification, 2026-05-19): C-2 confirmed end-to-end — 4.5× amplification observed (worse than the advisory's conservative 2× claim)

Waline login accepts a non-string email as a match-all MongoDB query — ## Summary The login endpoint POST /api/token reads the `email` field from the request body without checking its type and passes it straight into the

Seroval: Code injection through a typed array's own constructor property — ### Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a propert

Seroval: Script injection through RegExp sources in serialized output — ### Summary seroval writes a `RegExp` as a regular expression literal. In affected versions, the ` ` element that the serialized output is placed in,

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) — ### Summary `fromJSON` and `fromCrossJSON` used two node fields without checking them. - An array node's element list was not checked to be an array.

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length — ### Summary `fromJSON` and `fromCrossJSON` did not check that an array node's element list is an array. A small crafted payload could set the length t

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check — ### Summary When `fromJSON` rebuilt an async iterator, it called `on()` on the iterator's source without checking that the source was a seroval stream

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank — ## Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did

ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs — ## Summary ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor dimensions without verifying tha

ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute — ## Summary ONNX shape inference did not safely validate the required Scan `num_scan_inputs` attribute. Two malformed values could terminate or disrupt

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) — ## Summary ONNX shape inference performed an out-of-bounds read when processing a malformed RNN, GRU, or LSTM node from opsets 1–6 whose first input h

vLLM DeepSeek-OCR image processing vulnerable to denial of service — ## Summary Any vLLM deployment serving a model of the DeepSeek-OCR family — `deepseek-ai/DeepSeek-OCR`, `deepseek-ai/DeepSeek-OCR-2`, or `baidu/Unlimi

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE — ### Summary In vLLM 0.30.0, `ImageMediaIO` passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted fo

vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled — ## Affected - Ecosystem / package: pip / `vllm` - Affected versions: vLLM MultiModalKwargsItem: assert mm_item is not None, f"Expected an addr

vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs — ## Summary vLLM's `/v1/responses` endpoint accepts request-level `chat_template_kwargs`, but does not apply the `--trust-request-chat-template` gate t

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction — ## Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on o

Go JOSE: Panics in JSON parsing — ### Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https

Go JOSE: Panic during CBC-HMAC processing — ### Summary Decrypting a ciphertext with "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" can result in a panic on untrusted input. Note this advi

systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net — ### Summary On Linux, `[email protected]` builds `/sys/class/net/ ` paths from the caller-supplied `networkStats(iface)` value without checkin

systeminformation has prototype pollution in `networkStats()` via the interface name — ## Summary `networkStats()` keeps a per interface cache for computing `rx_sec` / `tx_sec` between calls. The cache is a plain JavaScript object and is

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE — ## Summary A critical architectural parser differential exists in the `zip` crate (` (&mut self, file: &mut ZipFile ) -> ZipResult { file.safe_prepare

LangGraph JavaScript custom authentication may permit cross-user Store access — ## Summary LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an aut

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock — `SoftReadWriteLock` (and `AsyncSoftReadWriteLock`, which wraps one) checks once per lock object, by name, that ` .rw`, ` .rw/gen` and ` .rw/holders` a

filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold — `StrictSoftFileLock` and `AsyncStrictSoftFileLock` apply the caller's `mode` to the sentinel (the lock file at ` `) and to both claim files (the files

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion — `StrictSoftFileLock`, `AsyncStrictSoftFileLock`, `SoftReadWriteLock` and `AsyncSoftReadWriteLock` keep their whole ownership state as files in a direc

filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL — filelock on Windows ignores the `mode` argument. `FileLock(path, mode=0o600)` creates the same file as `FileLock(path)`: one with no security descript

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout — `ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) run `PRAGMA journal_mode=MEMORY` on a fresh connection for every acqui

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker — `SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease`, their async variants and a `FileLock` that has fallen back to a soft lock on `ENOSYS` decide fr

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker — `raise_on_not_writable_file()` is the check that `SoftFileLock` and the locks sharing its acquire path run before every attempt. It looks at the lock

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path — `UnixFileLock`, the backend of `FileLock` and `AsyncFileLock` on Unix, empties whatever regular file it finds at the lock path once it holds the `floc

filelock: StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses — `StrictSoftFileLock` and `AsyncStrictSoftFileLock` check ` .filelock` (the coordination directory that holds the lock's state) with one `lstat` call o

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record — `SoftReadWriteLock` (and `AsyncSoftReadWriteLock`, which wraps one) refreshes its holder record (the file under ` .rw/holders/` that says a process ho

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders — The stale-lock break shared by `SoftFileLock`, `MarkerSoftFileLock` and `SoftFileLease` (and their async variants, and a `FileLock` that has fallen ba

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing — ### Summary OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted `tracestate` headers, potentia

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list — ### Summary When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n escapes the interpolation parameters before formatti

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages — ### Summary When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n passes the translated string through `sanitizeTransl

LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests — ### Summary The LangGraph Python SDK v3 streaming client interpolates caller-supplied `thread_id` and `assistant_id` values into request paths without

GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications — # Stale authentication state in `@graphql-tools/executor-legacy-ws`: per-request `extensions.connectionParams` persist in executor closure state and a

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller — # Cross-tenant subscription data leak in `@graphql-tools/executor-legacy-ws`: a shared `websocket.onmessage` is replaced on every `subscribe()`, and `

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers — ## Description `Context.Scheme()` unconditionally trusts four client-controlled HTTP headers to determine the request scheme, with no mechanism to con

Echo static file middleware route protection bypass via encoded dot-dot traversal — ## Summary Echo v5.2.0 contains a bypass of the fix for GHSA-vfp3-v2gw-7wfq. The fix rejects encoded path separators such as `%2F` and `%5C` before st

Echo has a Static Middleware Double-Unescape Path Traversal — ## Summary Commit a9ede66a (PR #3006, issue #2599) silently fixed a path traversal vulnerability in the Echo web framework's static file middleware. #

Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI — ## Summary Echo's dedicated open-redirect guard, `sanitizeURI`, decides whether a redirect target is a local path by inspecting exactly two byte posit

Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto — ## Summary The `c.Scheme()` method in Echo (`context.go:162-181`) trusts the `X-Forwarded-Proto`, `X-Forwarded-Protocol`, and `X-Url-Scheme` request h

Highcharts Grid: `javascript:` URL in credits.href runs script on click — ### Impact An attacker who controls the Grid configuration can set `credits.href` to a `javascript:` URL. The value is not validated against an allowe

Highcharts Grid parses pagination language options as HTML — ### Impact The pagination language strings are written into the DOM as markup rather than as text. An attacker who controls those language options can

Highcharts Dashboards parses fullscreen labels as HTML — ### Impact The edit mode fullscreen labels are parsed as HTML when the corresponding control is rendered. An attacker who controls the Dashboards lang

Highcharts Dashboards parses sidebar component labels as HTML — ### Impact The component language strings shown in the edit mode sidebar are parsed as HTML rather than inserted as text. An attacker who controls tho

Highcharts: `javascript:` URL in credits.href runs script on click — ### Impact A `credits.href` value beginning with `javascript:` is assigned to the window location when the credits label is clicked, without being che

Highcharts: dotted series.keys paths write to Object.prototype — ### Impact A dot-separated key path taken from `series.keys` is followed without filtering the individual segments. An attacker who controls `series.k

Highcharts: series column construction writes to Object.prototype — ### Impact When series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a

Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes — ### Impact The breadcrumbs `style` option is applied to the breadcrumb button as SVG attributes rather than as CSS, and the attribute names are not fi

Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` — ### Impact The input-type cell renderers copy every entry of the renderer's `attributes` option onto the input or select element they create, without

Highcharts Grid: custom icon definition objects written with raw `setAttribute` on ` ` — ### Impact A custom icon supplied under `rendering.icons` as an icon definition object is built by creating an SVG path for each of its child entries

Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace — ### Impact The Highcharts component uses the value of `chartConstructor` to select a function from the Highcharts namespace and invokes it with the co

Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. — ### Impact When a single cell value is written to a data table, the column id is used as a key on the table's column collection without filtering, so

Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` — ### Impact The data cursor keeps its listener and state bookkeeping in plain objects keyed by data table id, so a table id of `__proto__` supplied in

Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing — ### Impact When the HTML text parser cannot obtain a document from `DOMParser` because the call throws, it falls back to assigning the raw markup to t

Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts — ### Impact The filter applied to markup in text options checks `href`, `src` and a few similar attributes against an allowed-scheme list, but accepts

Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path — ## Summary When `middleware.Static` is mounted globally (`e.Use(middleware.Static(...))`) and an application relies on a **route- or group-level middl

Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob — ### Summary The `Context.JSONP`, `Context.JSONPBlob`, and internal `jsonPBlob` helper in `context.go` directly concatenate the caller-supplied `callba

Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration — ## Summary When `echo.New()` is used without explicitly setting `Echo#IPExtractor`, the `RealIP()` method falls back to reading the client-supplied `X

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method — ## Summary The `MethodOverride` middleware accepts any non-empty string as the override target method — including safe methods (GET, HEAD, OPTIONS, TR

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default — ## Summary The Echo proxy middleware (`middleware/proxy.go`) preserves an incoming `X-Real-IP` header verbatim and forwards it to the upstream service

mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 — ## URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 ### Summary `mcp-sanitizer` v1.3.3 fails to block Serv

mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths — ## File Path Sanitizer Permits Arbitrary User-Home Absolute Paths ### Summary `mcp-sanitizer` v1.3.3 explicitly whitelists `/home/` and `/Users/` as a

Server Security (10)

Tailscale SSH: Investigation and remediation update

Code-execution flaw in UEFI firmware threatens most servers on planet Earth

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server — ### Summary The OpenAI-compatible server registers Starlette `CORSMiddleware` with `allowed_origins` defaulting to `["*"]`, and performs no authentica

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine — ### Summary The Phi-4 multimodal audio encoder (`phi4mm_audio.py` / `phi4mm_utils.py`) runs its conformer attention in eager mode by default: the

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service — ## Summary The regular expression behind `GraphQLPhoneNumber` since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) — ### Summary permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 5

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string — ### Summary The URL-segment check added for GHSA-q89c-q3h5-w34g blocks `?`, `#`, `%`, `:`, `/` and `@` in `lng`, but not `&` or `=`, and the checked v

filelock: ReadWriteLock follows a symlink at the lock path into SQLite — ### Summary `ReadWriteLock` and `AsyncReadWriteLock` resolve the lock path with `pathlib.Path.resolve()` and pass it to `sqlite3.connect()` without re

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML — ## Summary happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing ` ` or ` ` elements. This behavior is

rucio has an Authorization Bypass on REST API endpoint for signing URLs — ## Summary The `/credentials/signurl` endpoint decides authorization from the client-supplied `X-Rucio-Account` HTTP header instead of the authenticat

Network Security (3)

Land Value Capture in Practice: Ethiopia's Urban Land Lease System

Latest Drop by DDoS Contains Contact Info for 40k DHS Employees

RE2JS: Quadratic-time denial of service in re2js lookbehind matching — ### Summary Using the opt-in `LOOKBEHINDS` flag together with any repeated-matching API (`matcher().find()` in a loop, `matchAll()`, `split()`, `match

*Total 95 security intelligence items, auto-collected by FoxTerm*

Trend Topics

Security Industry 3

Qwenputer: A functioning, deterministic RISC-V CPU inside Qwen3.5; Kentucky man becomes the first humanist granted religious exemption from AI; i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Vulnerability 79

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229; PHP2Shell, LiteLLM, GitLab: Find What You Need to Patch; PHP2Shell: Exploitation attempts and remediation trends; How fast can you actually patch Ruby?; Discovering and exploiting vulnerabilities in critical software with Claude; qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS); Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks; Tornado: Open redirect in RedirectHandler via protocol-relative URLs; Tornado: Quadratic CPU usage when parsing HTTP headers with line folding; Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass; systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks; Backstage catalog rules can be bypassed for URL locations using encoded path segments; Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it; knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion; Waline login accepts a non-string email as a match-all MongoDB query; Seroval: Code injection through a typed array's own constructor property; Seroval: Script injection through RegExp sources in serialized output; Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS); Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length; Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check; ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank; ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs; ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute; ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check); vLLM DeepSeek-OCR image processing vulnerable to denial of service; vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE; vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled; vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs; Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction; Go JOSE: Panics in JSON parsing; Go JOSE: Panic during CBC-HMAC processing; systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net; systeminformation has prototype pollution in `networkStats()` via the interface name; zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE; LangGraph JavaScript custom authentication may permit cross-user Store access; filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock; filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold; filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion; filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL; filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout; filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker; filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker; filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path; filelock: StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses; filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record; filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders; opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing; Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list; Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages; LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests; GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications; GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller; Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers; Echo static file middleware route protection bypass via encoded dot-dot traversal; Echo has a Static Middleware Double-Unescape Path Traversal; Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI; Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto; Highcharts Grid: `javascript:` URL in credits.href runs script on click; Highcharts Grid parses pagination language options as HTML; Highcharts Dashboards parses fullscreen labels as HTML; Highcharts Dashboards parses sidebar component labels as HTML; Highcharts: `javascript:` URL in credits.href runs script on click; Highcharts: dotted series.keys paths write to Object.prototype; Highcharts: series column construction writes to Object.prototype; Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes; Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`; Highcharts Grid: custom icon definition objects written with raw `setAttribute` on ` `; Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace; Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.; Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`; Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing; Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts; Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path; Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob; Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration; Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method; Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default; mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6; mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

Server Security 10

Tailscale SSH: Investigation and remediation update; Code-execution flaw in UEFI firmware threatens most servers on planet Earth; vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server; vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine; graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service; Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566); i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string; filelock: ReadWriteLock follows a symlink at the lock path into SQLite; Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML; rucio has an Authorization Bypass on REST API endpoint for signing URLs

Network Security 3

Land Value Capture in Practice: Ethiopia's Urban Land Lease System; Latest Drop by DDoS Contains Contact Info for 40k DHS Employees; RE2JS: Quadratic-time denial of service in re2js lookbehind matching