Executive Summary

FoxTerm Security Intel

October 31, 2026

Malware (1)

Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

Network Security (4)

Through Captain Jean-Luc Picard, Patrick Stewart taught us the measure of a man

Show HN: Overtone – Transcribe, correct and cut captions for any screen shape

minimatch has potential denial of service via globparts amplification — minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2. researcher: Reid Downing

imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash — ### Summary Out-of-bounds heap write in imgproxy's ICO loader (`vips/icoload.c`): when the ICO entry's image data buffer is small, the loader's BMP-he

Vulnerability (63)

Flock camera searches fell 95% after a dispatcher's misconduct was caught

4 Real? Tracking exploitation and patching of eMudhra's weak keys

Chained PHP2Shell exploit roots 25 servers, including US Government servers

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs — ## Summary The Kubeflow Pipelines API server's `GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log` handler retrieves logs without authorizing the c

pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search — ### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires opening an incomplete file without a

pypdf has possible large memory usage when parsing page tree — ### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the page tree with many sh

pypdf has possible infinite loop when cloning dictionaries — ### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires cloning/duplicating a `DictionaryObj

joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service — ### Summary `Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of whitespace. One request with 10

Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal — ### Summary In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directories in the background. The root

Authlib RFC 7592 examples omit registration-access-token client binding — ## Description ### Summary RFC 7592 (OAuth 2.0 Dynamic Client Registration Management Protocol) lets a previously registered client read, update, or d

pypdf has possible long runtimes when retrieving page labels — ### Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file.

pypdf has possible large memory usage for exceptions in strict mode — ### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading an invalid dictionary. ###

pypdf has possible long runtimes/large memory usage for encrypted PDF files — ### Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This requires accessing the page count

pypdf has possible large memory usage when parsing cross-reference streams — ### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires opening a file with cross-referenc

pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding — ## Summary In pyasn1 through 0.6.4, decoding a constructed BIT STRING with many fragments repeatedly shifts and copies the entire value accumulated so

pyasn1 has quadratic-complexity denial of service in binary REAL decoding — ## Summary In pyasn1 0.6.4 and earlier, decoding a binary-encoded ASN.1 REAL with a large mantissa can consume CPU time quadratic in the mantissa leng

pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding — ## Summary In pyasn1 0.6.4 and earlier, decoding a constructed OCTET STRING or character string made of many fragments can spend disproportionate CPU

Forge: ASN.1 OID first arc truncation in asn1.oidToDer — ### Summary `asn1.oidToDer()` did not range-check the first two arcs of an OID string, so an OID such as `0.42.840.113549.1.1.1` or `4294977127.18.840

Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie — ### Summary The `forge.http` client stored cookies from `Set-Cookie` response headers in a plain object keyed by cookie name and path. A malicious ser

Forge: TLS client crash when the server sends no certificate — ### Summary The forge TLS client's check for a missing server certificate read the wrong property and never ran. A malicious TLS server, or an on-path

Forge: Regular expression denial of service in PEM decoding (pem.decode) — ### Summary `pem.decode()`, which every node-forge API that parses PEM input uses, split messages with a regular expression that takes polynomial time

Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) — ### Summary `BigInteger.prototype.modInverse()` in node-forge's bundled jsbn library enters an infinite loop when the value or the modulus is negative

Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store — ### Summary When a CA store created by `pki.createCaStore()` holds two or more certificates with the same subject name, `pki.verifyCertificateChain()`

Forge: AES-GCM authentication bypass via unvalidated tagLength option — ### Summary The AES-GCM mode in forge.cipher does not validate the tagLength option passed to start(). With a tagLength of 0 or a value that converts

Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count — ### Summary forge.pkcs12.pkcs12FromAsn1() accepts a PKCS#12 MAC iteration count of zero (or less) from the input, and the PKCS#12 key derivation funct

Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message — ### Summary A connection created with `forge.tls.createConnection()` throws an uncaught `TypeError` from `process()` when it receives a record of anot

Forge: Denial of service in TLS record processing via call stack exhaustion — ### Summary Connections created with `forge.tls.createConnection()` processed received TLS records recursively, one stack level per record. A peer can

Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 — ### Summary node-forge parses certificate extensions with the deprecated OIDs `2.5.29.10` and `2.5.29.13` as `basicConstraints`, and `forge.pki.verify

Nuxt dev server exposes generated appSecret through Vite file serving — ### Impact When no `appSecret` is configured (via `NUXT_APP_SECRET`, `NITRO_APP_SECRET` or `runtimeConfig.appSecret`), `nuxt dev` generates a developm

Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes — ### Summary Since `4.6.0`, Nuxt resolves `.` and `..` segments in the request path, including percent-encoded forms such as `%2e`, before rendering a

Nuxt dev server arbitrary file read through client error reports — ### Summary A client that can connect to the dev server's HMR socket can send a `nuxt:dev:client-error` event whose message ends in an absolute file p

Nuxt dev server exposes private runtime config through the Nitro dev bundle — ### Summary With Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by `nuxt dev` can be fetched th

@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location — ### Summary @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location ## Affected versions and vulnerable location -

MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets — ## Summary MariaDB Connector/J sized heap allocations from lengths declared by the server in OK packets before checking that those lengths fit in the

MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths — ## Summary MariaDB Connector/J narrowed 8-byte length-encoded integers received from the server to `int` without validation. A rogue or MitM server ca

MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths — ## Summary `XAResource.recover()` in MariaDB Connector/J trusted the `gtrid_length` and `bqual_length` columns returned by `XA RECOVER` to allocate an

MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files — ## Summary MariaDB Connector/J checked a server's LOAD DATA LOCAL INFILE file request by searching the text of the command it had sent for `LOAD DATA

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing — ## Summary MariaDB Connector/J decodes every result as UTF-8 and guards `character_set_client` against a change to another charset, but did not guard

follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects — ### Summary follow-redirects 1.16.0 and 1.16.1 validate the documented sensitiveHeaders option with instanceof Array. An array created in another Java

russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets — ### Summary **All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synt

GraphQL-core has denial of service via memory leak in aborted validations — ### Summary When a validation was aborted because the document contained more errors than allowed by `max_errors` (100 by default), `validate()` raise

Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution — ### Summary Path traversal in the Signal K resources and applicationData APIs lets an unauthenticated or low-privileged user read, write and delete fi

imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution — ## Summary The ICO loader allocates `data_size + BMP_FILE_HEADER_LEN` bytes after reading a 32-bit attacker-controlled `data_size`. For `data_size > U

anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS — ## Summary anacrolix/torrent's bencode decoder (`bencode/`) applies no limit on the nesting depth of nested dictionaries and lists. Two distinct d

AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE — ### Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in A

AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers — ### Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forwarded-Prefix` HTTP header. An a

AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass) — ## Summary AdminNeo inserts the database server's version string into a ` ` tag that carries a valid CSP nonce, without any sanitization. A rogue data

AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass) — ## Summary Adminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not blocked and achieves the same

NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571 — ### Summary The URL validation regex `^(https?:/)?/.*` added to emissary's `NavAction.java` allows protocol-relative URLs (`//evil.com/...`) and singl

AdminNeo: version-cache array injection causes persistent denial of service — ### Summary AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `

joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption — ### Summary `joserfc.jwe.decrypt_json()`, the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled `recipients`

charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users — ## Summary Soft Serve cached repository records in memory with no expiry, and trusted the cached record for every access check. `SetPrivate` cleared t

charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories — ## Summary Soft Serve answers Go's `?go-get=1` requests by walking up the requested path until it finds a repository, then rendering that repository's

@nx/maven and @nx/gradle have OS command injection via nx.json plugin options — ## Summary `@nx/maven` and `@nx/gradle` spawn their project-graph analyzers through a shell and interpolate plugin options read from `nx.json` straigh

decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs — ### Summary `decodeUriComponent()` takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated reque

Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset — ## Summary An uncontrolled-resource-consumption vulnerability (CWE-400) in the Twisted HTTP/2 server lets any unauthenticated remote client exhaust se

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. — ### Summary - Verified version: zip `9.0.0-pre3` - Affected versions: `7.2.0` and later - Precondition: The attacker knows (or can guess)

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps — In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `c

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass — ### Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or

Keycloak vulnerable to information disclosure through arbitrary filesystem path probing — ### Description A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbit

Keycloak allows unauthorized access to resources via uma permission ticket bypass — ### Description A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for o

Keycloak vulnerable to authorization bypass via incorrect uri comparison — ### Description A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, i

Security Industry (3)

Qwenputer: A functioning, deterministic RISC-V CPU inside Qwen3.5

Deterministic Factoring in Time N^O(1)

pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding — ### Summary When an application decodes attacker-controlled BER, CER, or DER data without an ASN.1 schema, a container with many distinct long tag IDs

Server Security (12)

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service — ### Summary `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated

PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling — ### Summary When PHPT tests are run with code coverage, PHPUnit 13.4.0 to 13.4.3 writes the code of each PHPT test to a directory with a fixed name be

russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation — ### Summary The agent server in `russh::keys::agent::server` never calls `Agent::confirm` before signing with a key that was added with the confirm co

pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS) — ## Summary `pageant::PageantStream` reads a 4-byte big-endian length prefix from its input stream and buffers until `len + 4` bytes are available, wit

russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) — ## Summary A peer can advertise `maximum packet size = 0` in its channel-open message (`CHANNEL_OPEN` when attacking a server, `CHANNEL_OPEN_CONFIRMAT

russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages — ### Summary **All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synt

AdminNeo SQLite Database-List Drop Arbitrary File Deletion — ## Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop acti

AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery — ### Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked v

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service — ## Summary The regular expression behind `GraphQLPhoneNumber` since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size — ### Summary A malicious 149-byte ZIP archive can cause a denial of service in applications that enable `legacy-zip` and use `ZipArchive::extract()`. A

zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction — ### Summary The symbolic-link branch of `ZipArchive::extract_internal()` allocates a buffer using an attacker-declared size before reading any entry d

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials — ## Summary `Challenge` resources under `acme.cert-manager.io` can be created directly by namespace users. On create, cert-manager performs no admissio

Data Breach (1)

Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads — ### Summary In v2.52.1 and v2.52.2 the CORS middleware matched a wildcard origin such as `https://*.example.com` by suffix only, without a dot boundar

*Total 84 security intelligence items, auto-collected by FoxTerm*

Trend Topics

Malware 1

Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

Network Security 4

Through Captain Jean-Luc Picard, Patrick Stewart taught us the measure of a man; Show HN: Overtone – Transcribe, correct and cut captions for any screen shape; minimatch has potential denial of service via globparts amplification; imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash

Vulnerability 63

Flock camera searches fell 95% after a dispatcher's misconduct was caught; 4 Real? Tracking exploitation and patching of eMudhra's weak keys; Chained PHP2Shell exploit roots 25 servers, including US Government servers; GitLab Security Incident: Attempted Exploitation of CVE-2026-97229; Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs; pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search; pypdf has possible large memory usage when parsing page tree; pypdf has possible infinite loop when cloning dictionaries; joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service; Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal; Authlib RFC 7592 examples omit registration-access-token client binding; pypdf has possible long runtimes when retrieving page labels; pypdf has possible large memory usage for exceptions in strict mode; pypdf has possible long runtimes/large memory usage for encrypted PDF files; pypdf has possible large memory usage when parsing cross-reference streams; pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding; pyasn1 has quadratic-complexity denial of service in binary REAL decoding; pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding; Forge: ASN.1 OID first arc truncation in asn1.oidToDer; Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie; Forge: TLS client crash when the server sends no certificate; Forge: Regular expression denial of service in PEM decoding (pem.decode); Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891); Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store; Forge: AES-GCM authentication bypass via unvalidated tagLength option; Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count; Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message; Forge: Denial of service in TLS record processing via call stack exhaustion; Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13; Nuxt dev server exposes generated appSecret through Vite file serving; Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes; Nuxt dev server arbitrary file read through client error reports; Nuxt dev server exposes private runtime config through the Nitro dev bundle; @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location; MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets; MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths; MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths; MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files; MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing; follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects; russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets; GraphQL-core has denial of service via memory leak in aborted validations; Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution; imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution; anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS; AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE; AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers; AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass); AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass); NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571; AdminNeo: version-cache array injection causes persistent denial of service; joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption; charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users; charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories; @nx/maven and @nx/gradle have OS command injection via nx.json plugin options; decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs; Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset; zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.; Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps; Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass; Keycloak vulnerable to information disclosure through arbitrary filesystem path probing; Keycloak allows unauthorized access to resources via uma permission ticket bypass; Keycloak vulnerable to authorization bypass via incorrect uri comparison

Security Industry 3

Qwenputer: A functioning, deterministic RISC-V CPU inside Qwen3.5; Deterministic Factoring in Time N^O(1); pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding

Server Security 12

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service; PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling; russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation; pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS); russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang); russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages; AdminNeo SQLite Database-List Drop Arbitrary File Deletion; AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery; graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service; zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size; zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction; cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials