Executive Summary

FoxTerm Security Intel

October 30, 2026

Vulnerability (68)

CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation

Chained PHP2Shell exploit roots 25 servers, including US Government servers

Open-weight AI models can exploit the patch gap

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432

Two unpatched zero-day vulnerabilities in NTE allow for full account takeover

decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs — ### Summary `decodeUriComponent()` takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated reque

Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset — ## Summary An uncontrolled-resource-consumption vulnerability (CWE-400) in the Twisted HTTP/2 server lets any unauthenticated remote client exhaust se

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. — ### Summary - Verified version: zip `9.0.0-pre3` - Affected versions: `7.2.0` and later - Precondition: The attacker knows (or can guess)

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps — In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `c

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass — ### Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or

Keycloak vulnerable to information disclosure through arbitrary filesystem path probing — ### Description A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbit

Keycloak allows unauthorized access to resources via uma permission ticket bypass — ### Description A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for o

Keycloak vulnerable to authorization bypass via incorrect uri comparison — ### Description A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, i

Keycloak: Attacker can re-enable and take over disabled clients via registration access token — ### Description A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Toke

@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy — ## Unauthenticated Danswer API Confused Deputy Proxy in @eeacms/volto-chatbot ### Summary `@eeacms/volto-chatbot` exposes an Express middleware route

Crass: Non-ASCII characters cause superlinear CPU consumption — ### Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in

Crass: A large number of adjacent CSS comments can trigger a SystemStackError — ### Impact When the `:preserve_comments` option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming t

Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage — ### Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested

Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence — Cedar users must be using all of the following features to be affected by this advisory: JSON format policies, policy templates, and the `is in` scope

@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY — ### Impact When `@sylphx/pdf-reader-mcp` is run as an HTTP server (`MCP_TRANSPORT=http`), it reads the `MCP_API_KEY` environment variable and logs `AP

PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox — ### Summary JobWorkflowExecutor._exec_inline_python() is designed to safely execute inline Python expressions from YAML workflow script: steps using A

Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist — ### Impact Parse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files tha

Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware — ### Summary Daptin's `LanguageMiddleware` (registered as a global gin middleware) calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `A

PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets — ### Summary During the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious client can send a batch of mul

MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow — ### Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session bef

qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) — ## Summary `qs.stringify(obj, { arrayFormat: 'comma' })` throws an uncaught `TypeError: Cannot convert object to primitive value` when an array in `ob

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks — ### Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yieldin

Tornado: Open redirect in RedirectHandler via protocol-relative URLs — ### Summary `tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a template. Depending on where those su

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding — ### Summary Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold)

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass — ## Summary Crass's tokenizer didn't terminate a bad URL token at a `)` that followed an escaped backslash (`\\`). As a result, Crass consumed more inp

systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks — ### Summary On Windows, `[email protected]` builds a PowerShell command using the value passed to `services()`. The default sanitizer removes

Backstage catalog rules can be bypassed for URL locations using encoded path segments — ## Summary `@backstage/plugin-catalog-backend` matches URL-type locations against `catalog.rules` location patterns using the raw URL string submitted

Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it — ### Summary The main Electrum server the client connects to is trusted with mempool ("unconfirmed") transactions. This is documented [design](https://

knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion — ## ⚠️ Update (verification, 2026-05-19): C-2 confirmed end-to-end — 4.5× amplification observed (worse than the advisory's conservative 2× claim)

Waline login accepts a non-string email as a match-all MongoDB query — ## Summary The login endpoint POST /api/token reads the `email` field from the request body without checking its type and passes it straight into the

Seroval: Code injection through a typed array's own constructor property — ### Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a propert

Seroval: Script injection through RegExp sources in serialized output — ### Summary seroval writes a `RegExp` as a regular expression literal. In affected versions, the ` ` element that the serialized output is placed in,

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) — ### Summary `fromJSON` and `fromCrossJSON` used two node fields without checking them. - An array node's element list was not checked to be an array.

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length — ### Summary `fromJSON` and `fromCrossJSON` did not check that an array node's element list is an array. A small crafted payload could set the length t

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check — ### Summary When `fromJSON` rebuilt an async iterator, it called `on()` on the iterator's source without checking that the source was a seroval stream

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank — ## Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did

ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs — ## Summary ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor dimensions without verifying tha

ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute — ## Summary ONNX shape inference did not safely validate the required Scan `num_scan_inputs` attribute. Two malformed values could terminate or disrupt

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) — ## Summary ONNX shape inference performed an out-of-bounds read when processing a malformed RNN, GRU, or LSTM node from opsets 1–6 whose first input h

vLLM DeepSeek-OCR image processing vulnerable to denial of service — ## Summary Any vLLM deployment serving a model of the DeepSeek-OCR family — `deepseek-ai/DeepSeek-OCR`, `deepseek-ai/DeepSeek-OCR-2`, or `baidu/Unlimi

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE — ### Summary In vLLM 0.30.0, `ImageMediaIO` passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted fo

vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled — ## Affected - Ecosystem / package: pip / `vllm` - Affected versions: vLLM MultiModalKwargsItem: assert mm_item is not None, f"Expected an addr

vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs — ## Summary vLLM's `/v1/responses` endpoint accepts request-level `chat_template_kwargs`, but does not apply the `--trust-request-chat-template` gate t

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction — ## Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on o

Go JOSE: Panics in JSON parsing — ### Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https

Go JOSE: Panic during CBC-HMAC processing — ### Summary Decrypting a ciphertext with "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" can result in a panic on untrusted input. Note this advi

systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net — ### Summary On Linux, `[email protected]` builds `/sys/class/net/ ` paths from the caller-supplied `networkStats(iface)` value without checkin

systeminformation has prototype pollution in `networkStats()` via the interface name — ## Summary `networkStats()` keeps a per interface cache for computing `rx_sec` / `tx_sec` between calls. The cache is a plain JavaScript object and is

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE — ## Summary A critical architectural parser differential exists in the `zip` crate (` (&mut self, file: &mut ZipFile ) -> ZipResult { file.safe_prepare

LangGraph JavaScript custom authentication may permit cross-user Store access — ## Summary LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an aut

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock — `SoftReadWriteLock` (and `AsyncSoftReadWriteLock`, which wraps one) checks once per lock object, by name, that ` .rw`, ` .rw/gen` and ` .rw/holders` a

filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold — `StrictSoftFileLock` and `AsyncStrictSoftFileLock` apply the caller's `mode` to the sentinel (the lock file at ` `) and to both claim files (the files

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion — `StrictSoftFileLock`, `AsyncStrictSoftFileLock`, `SoftReadWriteLock` and `AsyncSoftReadWriteLock` keep their whole ownership state as files in a direc

filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL — filelock on Windows ignores the `mode` argument. `FileLock(path, mode=0o600)` creates the same file as `FileLock(path)`: one with no security descript

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout — `ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) run `PRAGMA journal_mode=MEMORY` on a fresh connection for every acqui

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker — `SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease`, their async variants and a `FileLock` that has fallen back to a soft lock on `ENOSYS` decide fr

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker — `raise_on_not_writable_file()` is the check that `SoftFileLock` and the locks sharing its acquire path run before every attempt. It looks at the lock

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path — `UnixFileLock`, the backend of `FileLock` and `AsyncFileLock` on Unix, empties whatever regular file it finds at the lock path once it holds the `floc

filelock: StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses — `StrictSoftFileLock` and `AsyncStrictSoftFileLock` check ` .filelock` (the coordination directory that holds the lock's state) with one `lstat` call o

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record — `SoftReadWriteLock` (and `AsyncSoftReadWriteLock`, which wraps one) refreshes its holder record (the file under ` .rw/holders/` that says a process ho

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders — The stale-lock break shared by `SoftFileLock`, `MarkerSoftFileLock` and `SoftFileLease` (and their async variants, and a `FileLock` that has fallen ba

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing — ### Summary OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted `tracestate` headers, potentia

Network Security (2)

Show HN: Overtone – Transcribe, correct and cut captions for any screen shape

RE2JS: Quadratic-time denial of service in re2js lookbehind matching — ### Summary Using the opt-in `LOOKBEHINDS` flag together with any repeated-matching API (`matcher().find()` in a loop, `matchAll()`, `split()`, `match

Security Industry (3)

Qwenputer: A functioning, deterministic RISC-V CPU inside Qwen3.5

Kentucky man becomes the first humanist granted religious exemption from AI

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf) — ## Affected versions Verified on 4.0.2 (latest on npm) and on commit 07e0288 (the GHSA-xvq9-wjp8-hwqf fix). Earlier 3.x/4.x versions that allow `/` in

Server Security (10)

Tailscale SSH: Investigation and remediation update

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size — ### Summary A malicious 149-byte ZIP archive can cause a denial of service in applications that enable `legacy-zip` and use `ZipArchive::extract()`. A

zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction — ### Summary The symbolic-link branch of `ZipArchive::extract_internal()` allocates a buffer using an attacker-declared size before reading any entry d

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials — ## Summary `Challenge` resources under `acme.cert-manager.io` can be created directly by namespace users. On create, cert-manager performs no admissio

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server — ### Summary The OpenAI-compatible server registers Starlette `CORSMiddleware` with `allowed_origins` defaulting to `["*"]`, and performs no authentica

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine — ### Summary The Phi-4 multimodal audio encoder (`phi4mm_audio.py` / `phi4mm_utils.py`) runs its conformer attention in eager mode by default: the

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service — ## Summary The regular expression behind `GraphQLPhoneNumber` since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) — ### Summary permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 5

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string — ### Summary The URL-segment check added for GHSA-q89c-q3h5-w34g blocks `?`, `#`, `%`, `:`, `/` and `@` in `lng`, but not `&` or `=`, and the checked v

filelock: ReadWriteLock follows a symlink at the lock path into SQLite — ### Summary `ReadWriteLock` and `AsyncReadWriteLock` resolve the lock path with `pathlib.Path.resolve()` and pass it to `sqlite3.connect()` without re

*Total 83 security intelligence items, auto-collected by FoxTerm*

Trend Topics

Vulnerability 68

CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation; Chained PHP2Shell exploit roots 25 servers, including US Government servers; Open-weight AI models can exploit the patch gap; GitLab Security Incident: Attempted Exploitation of CVE-2026-97229; Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432; Two unpatched zero-day vulnerabilities in NTE allow for full account takeover; decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs; Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset; zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.; Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps; Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass; Keycloak vulnerable to information disclosure through arbitrary filesystem path probing; Keycloak allows unauthorized access to resources via uma permission ticket bypass; Keycloak vulnerable to authorization bypass via incorrect uri comparison; Keycloak: Attacker can re-enable and take over disabled clients via registration access token; @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy; Crass: Non-ASCII characters cause superlinear CPU consumption; Crass: A large number of adjacent CSS comments can trigger a SystemStackError; Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage; Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence; @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY; PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox; Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist; Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware; PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets; MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow; qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS); Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks; Tornado: Open redirect in RedirectHandler via protocol-relative URLs; Tornado: Quadratic CPU usage when parsing HTTP headers with line folding; Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass; systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks; Backstage catalog rules can be bypassed for URL locations using encoded path segments; Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it; knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion; Waline login accepts a non-string email as a match-all MongoDB query; Seroval: Code injection through a typed array's own constructor property; Seroval: Script injection through RegExp sources in serialized output; Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS); Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length; Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check; ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank; ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs; ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute; ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check); vLLM DeepSeek-OCR image processing vulnerable to denial of service; vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE; vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled; vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs; Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction; Go JOSE: Panics in JSON parsing; Go JOSE: Panic during CBC-HMAC processing; systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net; systeminformation has prototype pollution in `networkStats()` via the interface name; zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE; LangGraph JavaScript custom authentication may permit cross-user Store access; filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock; filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold; filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion; filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL; filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout; filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker; filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker; filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path; filelock: StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses; filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record; filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders; opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

Network Security 2

Show HN: Overtone – Transcribe, correct and cut captions for any screen shape; RE2JS: Quadratic-time denial of service in re2js lookbehind matching

Security Industry 3

Qwenputer: A functioning, deterministic RISC-V CPU inside Qwen3.5; Kentucky man becomes the first humanist granted religious exemption from AI; i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Server Security 10

Tailscale SSH: Investigation and remediation update; zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size; zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction; cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials; vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server; vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine; graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service; Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566); i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string; filelock: ReadWriteLock follows a symlink at the lock path into SQLite