Koda Reef kodareef5

Koda Reef

Systematic vulnerability research. Custom tooling, manually verified findings.

Published record, March 2026 to present.

45 are searchable in GitHub's global advisory database: all · critical · high. 16 more are repository advisories that were never published to that database, so the search does not reach them. Each is linked individually in the table below.

Positive Technologies indexes the record and ranked it #1,071 of 55,057 researchers, 202.2 total CVSS across 27 indexed CVEs, checked 2026-07-30.

Credited in


Cloud native and orchestration
Supply chain and packaging
Identity and access
Data, AI and parsers
Web, proxy and applications

Upstream, outside the advisory system

Project	What	Credit
Apache HTTP Server	Integer overflow guards in four core escaping functions	"Submitted by: Koda Reef"
c-ares	Overflow checks in `ares_buf_ensure_space()`	Merged, downstream in Node.js
protoc-gen-validate	Malformed UTF-8 undercounted, bypassing length constraints	Merged
DOMPurify	Fix for CVE-2026-41240	Merged
File Browser #5888	Share owner permissions checked on public share access	Merged
File Browser #5889	Directory boundary enforced in rule path matching	Merged
File Browser #5890	Default permissions restricted for proxy-auth auto-provisioned users	Merged
File Browser #5891	Download permission checked in the resource handler	Merged

Credited in someone else's fix

Project	What	Credit
jsrsasign 11.1.2	HIGH, DSA universal signature forgery, FIPS 186-4 §4.7 boundary check	reported by Koda Reef, Nicholas Carlini and @Kr0emer
jsrsasign 11.1.2	HIGH, ASN.1 parser infinite loop in `getChildIdx`	reported by Koda Reef, sole
nginx 1.31.2	Constant time `secure_link` hash comparison	"Thanks to kodareef5"
GNOME GLib	D-Bus message length integer arithmetic	"Based on a report by Koda Reef"
CloudNativePG	Escaping in PostgreSQL config values	"Reported-by: Koda Reef"
CloudNativePG	Tightened recovery target validation	"Suggested-by: Koda Reef"
lighttpd	`mod_maxminddb` snprintf return bound	"(thx kodareef5)"
Headlamp v0.42.0	Host header validation	"thanks to Koda Reef for reporting"
NATS Server 2.14.3	Non-CVE fixes in the same release	Named in contributors
vim	Buffer underflow in `vim_fgets()`	"Solution: Ensure size is always greater than 1 (Koda Reef)", v9.2.0271
libevent	HTTP header parsing restricted against request smuggling	Release notes
libzip		THANKS
simple-git	`GIT_CONFIG_COUNT` injection	Changelog
authentik	SAML NameID truncation	Vendor CVE page
Red Hat	Five errata across OpenShift product lines	Downstream

libjpeg-turbo #877 sits outside both tables. The signed-overflow diagnosis was reported there and the maintainer wrote the fix across three commits, each closing with Fixes #877 — provenance by linkage, with no named credit.

One advisory carries the credit in prose but not in metadata: go-git GHSA-crhj-59gh-8x96 (CVE-2026-45571) reads "Thanks to @kodareef5, @AyushParkara and @N0zoM1z0 for reporting this to the go-git project in three separate reports." The structured credits list the other two. It is not counted in the 61.

Selected findings

Dgraph · CVE-2026-34976 CRITICAL 10.0

restoreTenant was absent from the middleware config map while its neighbour restore had full coverage, so it ran with no authentication, no IP allowlist and no audit logging. Chained to database overwrite, SSRF and file read pre-auth, no credentials needed. The fix was one line. Press.

Rancher Fleet · CVE-2026-41050 CRITICAL 9.9

Two Helm execution paths kept cluster-admin credentials during impersonated operations: the lookup template function, and valuesFrom secret references read through the same client. Patched across five Rancher trains.

Cilium · CVE-2026-41520 HIGH 7.9

cilium-bugtool and sysdump archives carried the WireGuard node key out of the cluster. The key is static and never rotates, so an archived support bundle decrypts node traffic and permits node impersonation until someone rotates it by hand.

Traefik · CVE-2026-41263 PATCH BYPASS

A BasicAuth timing fix had already shipped. The patch looked up a bcrypt hash as if it were a username, so the constant-time fallback secret was always empty and password checks failed in microseconds instead of running bcrypt. Reported path closed; class not. Measured at 130x against the shipped binary.

in-toto / witness · GHSA-ggg4-v8vp-jxqh CRITICAL

initConfig auto-loads .witness.yaml from the working directory before every command, so a file committed to the repository can redirect archivista-server and clear env-disable-default-sensitive-vars. An untrusted pull request against a pipeline running witness run exfiltrates GITHUB_TOKEN and cloud credentials. in-toto is a CNCF project.

pyLoad · CVE-2026-35459 CRITICAL 9.3 INCOMPLETE FIX

The fix for CVE-2026-33992 validated the initial download URL. pycurl was still configured with FOLLOWLOCATION=1 and ten redirects, none of them revalidated, so a redirect to 169.254.169.254 walks straight past the new check. The advisory carries the maintainers' own title: "Incomplete fix for CVE-2026-33992".

Tekton Pipelines · CVE-2026-40938 HIGH 7.5

The git resolver passed revision to git fetch as a positional argument, so --upload-pack=<binary> parsed as a flag, and validateRepoURL accepted local filesystem paths. The tekton-pipelines-resolvers ServiceAccount holds cluster-wide read on every Secret, so a tenant able to submit ResolutionRequest objects reaches all of them.

NASA · GHSA-r5f5-cv78-6qv8 HIGH 8.2

The C API trampoline in host.rs returns Continue(Some(out_result)) no matter what return signature was registered, so a void host call still pushes a value onto the operand stack. In a flight-compliant WebAssembly interpreter the stack silently desynchronises from what the validator proved.

Contour · CVE-2026-41246 HIGH 8.1

pathRewrite.value under cookieRewritePolicies is interpolated into the Envoy Lua filter through Go text/template with no escaping. Code runs inside a proxy shared by other tenants, reaching xDS client credentials on disk — their TLS keys, not just the attacker's own route.

nginx · 1.31.2 UPSTREAM CREDIT

The secure_link module compared its security hash without constant-time semantics. Fixed upstream and credited by name in the official changelog:

"constant time secure_link hash comparison. Thanks to kodareef5."

Composer · CVE-2026-40261 HIGH 8.8

Command injection through the Perforce source handler, reachable from package metadata, so the untrusted input is the package itself, which is the whole trust model of a dependency manager. Sole reporter. Red Hat shipped errata.

Coolify · CVE-2026-34168 HIGH 8.8

LocalPersistentVolume.name is interpolated straight into docker volume shell commands with no argument escaping, so shell metacharacters in a storage name execute when the resource is deleted. Any authenticated user with an API token reaches command execution on every managed server.

OneUptime · CVE-2026-34759 CRITICAL 9.2

Notification API endpoints were registered without auth middleware while every neighbouring endpoint had it. An unauthenticated caller could buy phone numbers on the victim's Twilio account, delete existing alert numbers, and reach SMTP credentials. A projectId leaking from the public status-page API made it reachable from nothing. Sole reporter.

NATS Server · three advisories ALL INCOMPLETE FIXES

One batch, three advisories, each titled by the maintainers as an incomplete fix for an earlier CVE. Leafnode handshake crash (High 8.6) survived two prior fixes, CVE-2026-29785 and CVE-2026-33218. MQTT ACL bypass and trace-permission bypass each survived one. Sole reporter on all three.

The data

Severity, as published in each advisory

Critical	High	Medium	Low
5	33	18	5
`█████`	`█████████████████████████████████`	`██████████████████`	`█████`

Ecosystem

Go	JavaScript	Python	Rust	PHP	C++
32	9	8	6	5	1
`████████████████████████████████`	`█████████`	`████████`	`██████`	`█████`	`█`

Weaknesses, as classified by the maintainers in each advisory

Weakness		Found in
CWE-863	Authorization check exists but is wrong	Rancher · ZITADEL · RustFS · File Browser · pyLoad · NATS · OpenTelemetry
CWE-918	Server-side request forgery	pyLoad · Novu · SiYuan · FreeScout · Soft Serve · AVideo · Astro
CWE-862	Authorization check missing entirely	Dgraph · OneUptime · Wekan · RustFS · File Browser
CWE-22	Path traversal	gitoxide · Tekton · File Browser · Poetry
CWE-78	OS command injection	Coolify · Composer · BentoML
CWE-200	Sensitive information exposed	gitoxide · Cilium · External Secrets
CWE-287	Authentication can be bypassed	ZITADEL · Pocket ID
CWE-296	Certificate chain not properly followed	in-toto
CWE-178	Case sensitivity mishandled	Gotenberg · python-tuf
CWE-208	Timing side channel	Traefik · phpseclib
CWE-20	Input not validated	Composer · oauth2-proxy

The 11 classes above account for 40 of 69 classifications; a further 29 classes appear once each, across 40 distinct weaknesses in total.

Incomplete fixes

A patch shipped, and the bug class survived it. Every row below is titled or described as an incomplete fix by the maintainers themselves.


NATS Server	"Pre-auth server crash via double INFO in leafnode handshake — incomplete fix for CVE-2026-29785 and* CVE-2026-33218"*
NATS Server	"MQTT subscribe ACL bypass via `$MQTT.deliver.pubrel` prefix (incomplete fix for CVE-2026-33217)"
NATS Server	"Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check"
pyLoad	"SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)"
pyLoad	"Unprotected `storage_folder` enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)"
Gotenberg	"Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags"
File Browser	Proxy-auth auto-provisioned users inherit Execute permission — the advisory describes it as an incomplete fix for the earlier signup restriction

One of these — the NATS leafnode crash — survived two prior CVE fixes.

Coverage

"Security researcher Koda Reef discovered that the exposed restoreTenant endpoint ran with no authentication, no IP allowlist and no audit logging." — GBHackers, on the Dgraph 10.0

Finding
Dgraph CVE-2026-34976	GBHackers · Cybersecurity News
Rancher Fleet CVE-2026-41050	GBHackers · CyberPress · Lyrie Research
pyLoad CVE-2026-35459	SANS AtRisk XXVI-14
Contour CVE-2026-41246	ZeroPath
Tekton CVE-2026-40938	CVEReports

Advisories

Plus CVE-2026-5366. Critical, git argument injection in Prefect deployment pull steps via an unsanitized commit_sha, across four injection points. Reported and CVE-assigned through huntr; fixed upstream. Not among the 61 below, which are advisory credits only.

Severity	Finding	Detail
	go-git/go-git Symlink following _2026-07-30	The `worktreeFilesystem` wrapper rejected dangerous path strings but never resolved existing symlinks, so writing to `s/config` where `s` links to `.git` modifies Git metadata. An attacker who can plant a symlink and trigger a write escapes the worktree. _{GHSA-hc8v-wwc9-vgxm}
	charmbracelet/soft-serve SSRF _2026-07-30	`validateImportRemote` in `pkg/backend/repo.go` only checked for a non-empty host, never calling the existing `ssrf.ValidateURL`, and `pkg/jobs/mirror.go` re-fetched the stored URL unvalidated. Any user with a registered SSH key reaches loopback, RFC1918 and cloud metadata, re-triggered every sync. _{GHSA-vpj5-m56f-8h3f}
	pocket-id/pocket-id Authorization bypass _2026-07-28	`createTokenFromRefreshToken` verifies the refresh token's signature but never rechecks `user.Disabled`, the authorization record, or group restrictions. Anyone holding a pre-existing refresh token and client credentials keeps issuing tokens indefinitely, so disabling a terminated account no longer revokes downstream OIDC access. _{GHSA-w6p7-2fxx-4f44 · CVE-2026-43983}
	pocket-id/pocket-id Authentication bypass _2026-07-28	The `/api/webauthn/reauthenticate` fallback validates only access-token freshness (60 seconds) and the presence of a `session` cookie, not the original login method. An attacker holding a one-time access token gains OIDC tokens for step-up-protected clients, including a renewable 30-day refresh token. _{GHSA-hp74-gm6m-2qm5}
	nasa/spacewasm Type confusion _2026-07-27	The C API trampoline in `host.rs` returns `Continue(Some(out_result))` regardless of the registered return signature, so void host calls still push a value. Guest modules receive corrupted operand-stack values, and repeated void calls push `sp` beyond the allocation, ending in SIGSEGV. _{GHSA-r5f5-cv78-6qv8}
	activepieces/activepieces Command injection _2026-07-17	A Code step's name, validated only as `z.string()`, reaches a `/bin/sh`-invoked `bun build` as a path component, so metacharacters execute commands. Any authenticated user who can create a flow runs commands as the worker user, root by default, before sandboxing. _{GHSA-3pfv-m69p-5fv5}
	in-toto/witness Secret exfiltration _2026-07-10	`initConfig` auto-loads `.witness.yaml` from the working directory before every command, letting a repo-local file set `archivista-server` and `env-disable-default-sensitive-vars`. An untrusted pull request to a pipeline running `witness run` exfiltrates CI environment variables, including `GITHUB_TOKEN` and cloud credentials, to the attacker. _{GHSA-ggg4-v8vp-jxqh}
	in-toto/witness Certificate validation _2026-07-10	A typo at `cmd/verify.go:146` assigns `append(policyIntermediates, cert)` to `policyRoots`, replacing loaded root CAs with the last intermediate and leaving `policyIntermediates` empty. Chain verification breaks for deployments using intermediate CA hierarchies; direct root-signed certificates are unaffected. _{GHSA-88v8-jcjq-95w5}
	in-toto/go-witness Certificate validation _2026-07-10	Line 179 of `attestation/policyverify/policyverify.go` runs `append(intermediates, intermediates...)` instead of appending `trustBundle.Intermediates`, so the pool handed to `x509.VerifyOptions` stays empty. Attestations signed through an intermediate CA fail chain verification; the failure is closed, so nothing unverified is accepted. _{GHSA-6xq9-h39h-jc22}
	nats-io/nats-server Denial of service _2026-07-08	Repeated leafnode `INFO` messages sent before authentication and account setup complete leave handshake state nil, which is later dereferenced and panics the process. Any unauthenticated peer reaching a leafnode listener with compression enabled crashes the server; disabling that compression mitigates. _{GHSA-3g5q-cfh2-cq67 · CVE-2026-58250}
	nats-io/nats-server Authorization bypass _2026-07-08	The restriction on internal `$MQTT.*` subjects missed the `$MQTT.deliver.pubrel` family, letting an authenticated MQTT client subscribe to it. Configured subscribe permissions are bypassed, exposing QoS2 protocol metadata for sessions in the account; message payloads are not exposed. _{GHSA-4g68-3pwx-5vfj · CVE-2026-58214}
	nats-io/nats-server Authorization bypass _2026-07-08	Trace destination permission checks apply to client connections but not consistently to messages arriving over leafnode connections. A leafnode operator can send trace events to disallowed subjects, exposing routing, account and JetStream metadata, and suppress normal delivery. _{GHSA-p3j5-5hrq-p75h · CVE-2026-58254}
	coollabsio/coolify Command injection _2026-07-07	`LocalPersistentVolume.name` is interpolated into `docker volume rm -f $storage->name` without `escapeshellarg()` across eight models, while the API storage validator accepts any string. An authenticated API token holder gets root command execution on managed servers once the resource is deleted. _{GHSA-mh8x-fppq-cp77 · CVE-2026-34168}
	zitadel/zitadel Missing identity binding _2026-06-18	`CodeExchange` and `RefreshToken` skip the RFC 6749 §4.1.3 check binding a grant to the client that requested it. A code or refresh token stolen via a separate application flaw can then be redeemed under any other client, even another tenant's. _{GHSA-xqxv-4jc2-x56x · CVE-2026-55672}
	open-telemetry/opentelemetry-collector-contrib Logic flaw _2026-06-18	`handleReq()` never reads `RequiredHeaders`, which the config validates at startup but no request path ever checks, unlike `gitlabreceiver`. Since `secret` also defaults to empty and skips HMAC validation, anyone can post arbitrary payloads and inject fake CI/CD trace data. _{GHSA-w5cv-pw74-4rxc · CVE-2026-55701}
	goauthentik/authentik Validation bypass _2026-06-02	`ResponseProcessor.parse()` never inspects the assertion's `Conditions` element, so `NotBefore`, `NotOnOrAfter` and `AudienceRestriction` are all ignored. Anyone holding a valid assertion can replay it indefinitely after its signed expiry, and assertions minted for a different service provider are accepted. _{GHSA-4v4x-x5pr-8gp2 · CVE-2026-41577}
	wekan/wekan Authorization bypass _2026-05-30	The `copyBoard` Meteor method in `server/publications/boards.js` runs no membership or admin check, and copies caller-supplied `properties` onto the board before cloning. Any logged-in user clones a private board with all cards and checklists, and can mark the copy `public`. _{GHSA-7w2h-g83c-jqrp · CVE-2026-53445}
	go-git/go-git Denial of service _2026-05-29	Parsing crafted `.pack`, `.idx` or loose object files causes panics or excessive resource consumption. Applications that clone, fetch or open untrusted repositories can be driven to denial of service, requiring write access to `.git/objects/pack/` or a malicious remote. _{GHSA-w5pp-99ch-qj29}
	theupdateframework/python-tuf Delegation confusion _2026-05-28	`DelegatedRole._is_target_in_pathpattern` matches delegation globs with `fnmatch.fnmatch`, which applies `os.path.normcase()`, an identity on POSIX but lowercasing on Windows. On Windows clients, an attacker controlling a delegated role whose case-colliding pattern is walked first can serve targets belonging to another delegation. _{GHSA-qp9x-wp8f-qgjj}
	strukturag/libheif Heap buffer overflow _2026-05-19	A 32-bit multiplication in the stride calculation at `pixelimage.cc:591` wraps for large widths, undersizing the image plane allocation. Subsequent plane writes overflow the heap, so a crafted HEIF or AVIF file crashes or potentially compromises any application built on libheif. _{GHSA-9h96-c44j-jpq9}
	rancher/fleet Impersonation bypass _2026-05-07	Helm `lookup` queries and `helm.valuesFrom` Secret/ConfigMap reads bypass ServiceAccount impersonation, using the fleet-agent's `cluster-admin` credentials. A tenant with git push access to a Fleet-monitored repository reads Secrets in any namespace on downstream clusters their GitRepo targets; single-tenant setups are unaffected. _{GHSA-765j-qfrp-hm3j · CVE-2026-41050}
	GitoxideLabs/gitoxide Denial of service _2026-05-05	`apply()` in `gix-pack/src/data/delta.rs` reads delta operands with unchecked `data[i]` indexing, and pack entry size headers reach `Vec::with_capacity`/`resize` uncapped. A malicious remote crashes any process that clones or fetches, via a truncated-delta panic or a multi-terabyte allocation from a forged header. _{GHSA-x494-mj8g-cj27}
	GitoxideLabs/gitoxide Path traversal _2026-05-05	Submodule name validation checks only the first `..`, and `git_dir()` never calls it, so crafted `.gitmodules` names escape `.git/modules`. `Submodule::open()` inherits the parent's `Trust::Full`, skipping ownership checks, so a victim running submodule operations after cloning leaks git configs and credentials. _{GHSA-p3hw-mv63-rf9w}
	rustfs/rustfs Missing authorization _2026-05-05	`ListServiceAccount` authorizes cross-user requests against `UpdateServiceAccountAdminAction` instead of `ListServiceAccountsAdminAction`, and the update handler performs no ownership check on the target access key. A user granted only `admin:UpdateServiceAccount` enumerates every account's keys, including root's, then rotates the root service account secret. _{GHSA-mm2q-qcmx-gw4w}
	kata-containers/kata-containers Policy subversion _2026-05-04	The `CopyFileRequest` policy rule validates only `input.path` against the shared directory, ignoring `data`, which the agent treats as a symlink target. An untrusted host links out of that directory and overwrites binaries inside the guest image, even under Confidential Containers. _{GHSA-q49m-57vm-c8cc · CVE-2026-41326}
	cilium/cilium Information disclosure _2026-04-25	The debug archive from `cilium-bugtool`, also gathered by `cilium sysdump`, includes `cilium_wg0.key`, the WireGuard private key for node-to-node encryption. Anyone holding a shared archive from a WireGuard-enabled node obtains that key, which must then be rotated. _{GHSA-gj49-89wh-h4gj · CVE-2026-41520}
	projectcontour/contour Code injection _2026-04-24	`pathRewrite.value` under `cookieRewritePolicies` is interpolated into the Envoy Lua filter's source via Go `text/template` without escaping. A user with RBAC rights over HTTPProxy resources runs arbitrary Lua in the shared Envoy, reading its xDS credentials and other tenants' TLS keys. _{GHSA-x4mj-7f9g-29h4 · CVE-2026-41246}
	traefik/traefik Timing side-channel _2026-04-24	The intended constant-time fallback secret always resolves to an empty string, so BasicAuth's comparison short-circuits instead of a full bcrypt evaluation. Anyone able to reach the protected route can distinguish existing usernames from non-existent ones by measuring authentication response times. _{GHSA-6x2q-h3cr-8j2h · CVE-2026-41263}
	withastro/astro SSRF _2026-04-23	The `fetch()` for remote images in `image-binding-transform.ts` omits the `{ redirect: 'manual' }` the other image paths use, so `isRemoteAllowed()` validates only the initial URL. An open redirect on an allowed domain reaches blind SSRF targets outside `image.domains`. _{GHSA-88gm-j2wx-58h6 · CVE-2026-41321}
	rustfs/rustfs Missing authorization _2026-04-22	The four notification-target endpoints in `admin/handlers/event.rs` authenticate via `check_permissions` but never perform `validate_admin_request` authorization. A read-only user can overwrite a target by name, redirecting bucket events to an attacker-controlled webhook, and reach internal hosts through the unvalidated health probe. _{GHSA-pfcq-4gjr-6gjm · CVE-2026-40937}
	cure53/DOMPurify Validation bypass _2026-04-22	When `EXTRA_ELEMENT_HANDLING.tagCheck` is a function returning true, short-circuit evaluation skips the `FORBID_TAGS[tagName]` check, unlike the `FORBID_ATTR` early exit. A configuration using function-based `ADD_TAGS` alongside `FORBID_TAGS` keeps `iframe`, `object`, `embed` and `form` elements with their `src`/`action` attributes intact. _{GHSA-h7mw-gpvr-xq4m · CVE-2026-41240 · fix #1230}
	python-poetry/poetry Path traversal _2026-04-22	`extractall()` in `poetry/utils/helpers.py` falls back to unfiltered `tarfile.extractall()` on Pythons without a working `data_filter` (3.10.0-3.10.12, 3.11.0-3.11.4). A malicious sdist's `../`, symlink, or hardlink members escape the target directory during `poetry add --lock` resolution, before the build backend runs `setup.py` anyway. _{GHSA-73h3-mf4w-8647 · CVE-2026-41140}
	tektoncd/pipeline Information disclosure _2026-04-21	`ResolveAPIGit()` builds an SCM client from the user-supplied `serverURL`; omitting the `token` param makes `getAPIToken()` attach the system Git token. Any tenant with TaskRun create permission captures that token by pointing `serverURL` at their own server, gaining private-repository access. _{GHSA-wjxp-xrpv-xpff · CVE-2026-40161}
	tektoncd/pipeline Validation bypass _2026-04-21	The `/tekton/` mount restriction uses `strings.HasPrefix` without `filepath.Clean`, so `/tekton/home/../results` clears the `/tekton/home` exemption and resolves to `/tekton/results`. A user who can create Tasks or TaskRuns mounts over internal state, forging task results or replacing step scripts. _{GHSA-rx35-6rhx-7858 · CVE-2026-40923}
	tektoncd/pipeline Logic flaw _2026-04-21	`checkout()` passes the user-supplied `revision` verbatim to `git fetch`, so `--upload-pack=<binary>` parses as a flag; `validateRepoURL` also allows local paths. A tenant who can submit `ResolutionRequest` objects and predict a pod-local repo path gains code execution and cluster-wide Secret read. _{GHSA-94jr-7pqp-xhcq · CVE-2026-40938}
	statamic/cms Unsafe method invocation _2026-04-16	Query parameter and GraphQL argument values resolve into method invocations, so attacker-chosen names call destructive methods. Content, assets and users can be deleted with only a minimal Control Panel permission like `view entries`, or unauthenticated where REST/GraphQL are enabled. _{GHSA-4jjr-vmv7-wh4w · CVE-2026-41175}
	oauth2-proxy/oauth2-proxy Authorization bypass _2026-04-15	`email_domain` enforcement accepts a claim with multiple `@` characters, so `attacker@evil.com@company.com` satisfies an allowlist entry for `company.com`. Access reserved for the permitted domain is granted, but only where the provider can emit malformed claims; providers enforcing email syntax are unaffected. _{GHSA-c5c4-8r6x-56w3 · CVE-2026-40574}
	composer/composer Command injection _2026-04-14	`Perforce::syncCodeBase()` appends the `$sourceReference` from package metadata into a shell command unescaped, as does `generateP4Command()` with connection parameters from the source URL. Any repository serving a package with `source.type: perforce` runs commands during `--prefer-source` installs, even where Perforce is absent. _{GHSA-gqw4-4w2p-838q · CVE-2026-40261}
	novuhq/novu SSRF _2026-04-14	The conditions filter passes `child.webhookUrl` straight to `axios.post()`, skipping the `validateUrlSsrf()` check applied by the HTTP Request step. A user with workflow configuration access reaches internal endpoints such as AWS IMDSv1, and the response body is readable through `GET /execution-details`. _{GHSA-4x48-cgf9-q33f}
	external-secrets/external-secrets Data exfiltration _2026-04-13	The v2 template engine removes Sprig's `env` and `expandenv` but leaves `getHostByName`, and renders templates inside the controller process. A user who can author templated `ExternalSecret` resources turns secret values into controller-side DNS lookups, exfiltrating them without outbound network access. _{GHSA-r2pg-r6h7-crf3 · CVE-2026-34984}
	siyuan-note/siyuan SSRF _2026-04-10	`securityLevel: "loose"` and `htmlLabels: true` let `<img src>` survive Mermaid's sanitiser, and `mermaidRender.ts` injects the SVG via `innerHTML`. Opening a crafted note fetches the URL; on Windows a protocol-relative src resolves as a UNC path, sending the victim's NTLMv2 hash. _{GHSA-w95v-4h65-j455 · CVE-2026-40107}
	phpseclib/phpseclib Timing side-channel _2026-04-10	`SSH2::get_binary_packet()` compares the received packet HMAC using `!=`, which dispatches to `memcmp()` and short-circuits on the first differing byte. Every non-AEAD session leaks a 3-14 ns signal, but MAC failure disconnects and rekeys, so no practical remote attack exists. _{GHSA-r854-jrxh-36qx · CVE-2026-40194}
	henrygd/beszel IDOR _2026-04-10	`containerRequestHandler`, `getSystemdInfo`, and `refreshSmartData` fetch the system ID from the query string without verifying caller membership. Any authenticated user, including read-only ones, reads container logs or triggers SMART refreshes on systems they don't own, after guessing a random 15-character ID. _{GHSA-5f5r-95pg-xrpm · CVE-2026-40077}
	py-pdf/pypdf Resource exhaustion _2026-04-10	Entity declarations in a PDF's XMP metadata are processed without limits when that metadata is parsed. A crafted document drives memory usage high enough to exhaust RAM; exploitation requires the application to parse XMP metadata. _{GHSA-3crg-w4f6-42mx · CVE-2026-40260}
	sigstore/cosign Verification bypass _2026-04-08	`verify-blob-attestation` mishandled errors from predicate-type validation for old-format bundles and detached signatures, and skipped that validation entirely for new-format bundles. Without `--check-claims=true`, an attestation with a valid signature but an unparsable payload or mismatched `--type` is reported as Verified OK. _{GHSA-w6c6-c85g-mmv6 · CVE-2026-39395}
	filebrowser/filebrowser Permission inheritance _2026-04-08	`withHashFile` in `http/public.go` resolves the share and its owner but never re-checks `user.Perm.Share` or `Perm.Download`, unlike `withPermShare`. After an admin revokes those permissions, existing links stay downloadable by unauthenticated visitors even though new share creation returns 403. _{GHSA-v9w4-gm2x-6rvf · CVE-2026-35604 · fix #5888}
	open-telemetry/opentelemetry-go Logic flaw _2026-04-08	`host_id.go` passes the bare name `kenv` to `execCommand`, unlike the Darwin path's absolute `/usr/sbin/ioreg`, so `exec.Command` searches `$PATH`. A local user who plants a `kenv` binary earlier in `$PATH` executes code inside the OTel-using process on BSD and Solaris hosts. _{GHSA-hfvc-g4fc-pqhx · CVE-2026-39883}
	filebrowser/filebrowser Permission inheritance _2026-04-08	`createUser()` in `auth/proxy.go` applies `setting.Defaults` without the `Perm.Execute = false` and empty-`Commands` resets the signup handler performs. Accounts auto-provisioned on first proxy-auth login inherit the admin-configured default commands and execute permission, in deployments using `--auth.method=proxy` with exec enabled. _{GHSA-7526-j432-6ppp · CVE-2026-35607 · fix #5890}
	filebrowser/filebrowser Information disclosure _2026-04-08	`resourceGetHandler` hardcodes `Content: true` and serves the `X-Encoding` raw-byte path without the `Perm.Download` check applied by `/api/raw`, `/api/preview`, `/api/subtitle`. An authenticated user with `download: false` reads full text file contents, including credentials, within their scope; path authorization is unaffected. _{GHSA-67cg-cpj7-qgc9 · CVE-2026-35606 · fix #5891}
	filebrowser/filebrowser Access control bypass _2026-04-08	`Rule.Matches()` in `rules/rules.go` ends at `strings.HasPrefix(path, r.Path)` with no trailing separator, so an allow rule for `/shared` also matches `/shared_private/secret.txt`. Authenticated users reach sibling directories that share a prefix with an allowed path; deny rules over-match the same way. _{GHSA-5q48-q4fm-g3m6 · CVE-2026-35605 · fix #5889}
	gotenberg/gotenberg Policy subversion _2026-04-07	The `dangerousTags` filter deletes only exact-case `FileName` and `Directory`, omitting `HardLink` and `SymLink`, while ExifTool resolves tag names case-insensitively. Any caller of `/forms/pdfengines/metadata/write`, unauthenticated by default, writes files or links to arbitrary paths, limited to the container filesystem when containerized. _{GHSA-qmwh-9m9c-h36m}
	authorizerdev/authorizer Missing authorization _2026-04-06	Six endpoints append tokens to a caller-supplied `redirect_uri` without the `validators.IsValidOrigin()` check that `app.go` applies, so `AllowedOrigins` is bypassed. An unauthenticated attacker steals password-reset, magic-link and, via `verify_email`, access, id and refresh tokens once the victim clicks the emailed link. _{GHSA-x3f4-v83f-7wp2}
	pyload/pyload SSRF _2026-04-04	`BaseDownloader.download()` validates only the initial URL's host, and pycurl follows up to ten redirects with no revalidation (`FOLLOWLOCATION=1`). An authenticated user with ADD permission submits a link redirecting to 169.254.169.254 or internal hosts, writing IAM credentials into the storage folder. _{GHSA-7gvf-3w72-p2pg · CVE-2026-35459}
	pyload/pyload Arbitrary file write _2026-04-04	`storage_folder` is not in `ADMIN_ONLY_OPTIONS`, and its path check covers only `PKGDIR` and userdir, not Flask's session store. A non-admin with SETTINGS and ADD downloads a pickle payload there; any unauthenticated request with the crafted cookie achieves code execution. _{GHSA-4744-96p5-mp2j · CVE-2026-35464}
	bentoml/BentoML Command injection _2026-04-03	`_build_setup_script` joins `system_packages` from `bentofile.yaml` into an `apt-get install` f-string without the `shlex.quote` added elsewhere in commit ce53491. A package entry containing `;` runs arbitrary commands inside the generated `setup.sh`, which is uploaded and executed on BentoCloud build infrastructure. _{GHSA-fgv4-6jr3-jgfw · CVE-2026-35043}
	dgraph-io/dgraph SSRF _2026-04-02	`restoreTenant` is missing from `adminMutationMWConfig`, so its middleware lookup returns nil and it runs without auth, IP allowlist or audit logging. Unauthenticated callers overwrite a namespace from an attacker-hosted backup, enumerate the filesystem via `file://`, and trigger SSRF through `vaultAddr`. _{GHSA-p5rh-vmhp-gvcw · CVE-2026-34976}
	OneUptime/oneuptime Missing authentication _2026-04-02	Five routes in `PhoneNumber.ts` register without `ClusterKeyAuthorization.isAuthorizedServiceMiddleware`, run queries as `isRoot`, and Nginx proxies `/notification` publicly. Because the status page API leaks `projectId`, an unauthenticated attacker buys Twilio numbers on the victim's account and releases existing ones, ending call-based alerting. _{GHSA-6wc5-rhvj-cx7f · CVE-2026-34759}
	StableLib/stablelib Signature malleability _2026-04-01	`verify()` passes signature bytes 32-63 to `scalarbase()` with no `S<L` range check, so `S` and `S+L` verify identically. Anyone with a valid signature derives a second valid one without the private key, breaking systems that treat signatures as unique identifiers. _{GHSA-x3ff-w252-2g7j}
	freescout-help-desk/freescout SSRF _2026-03-31	`checkIpByMask()` returns false whenever the IP contains no `/`, so plain addresses never reach the `IpUtils::checkIp()` loop and CIDR entries go unenforced. Inbound-email attachment URLs into `10.0.0.0/8`, `172.16.0.0/12`, or `fd00::/8` are fetched by the server, and `192.168.0.0/16` is missing entirely. _{GHSA-c9v3-4c59-x5q2 · CVE-2026-34443}
	Giskard-AI/giskard-oss Template injection _2026-03-27	`ChatWorkflow.chat()` wraps a plain string argument in `MessageTemplate`, whose `render()` compiles it with a non-sandboxed Jinja2 `Environment`. If an application passes user input to `chat()`, `{{...}}` class traversal reaches `os.popen` and yields remote code execution; `.with_inputs()` values stay safe. _{GHSA-frv4-x25r-588m · CVE-2026-34172}
	WWBN/AVideo SSRF _2026-03-26	`isSSRFSafeURL()` validates the hostname's resolved IP, but `url_get_contents()` then calls `file_get_contents()` with PHP's default `follow_location=1`, so redirect targets are never rechecked. A user with upload and edit permissions passes `downloadURL_image` a URL that 302s to cloud metadata or internal services. _{GHSA-f359-r3pv-2phf · CVE-2026-33766}