A cross-site scripting (XSS) vulnerability exists in the HeliumEdu platform prior to version 2.2.60. Authenticated users can upload SVG and HTML attachments via the POST /planner/attachments/ endpoint because these formats are not blocked. Uploaded SVG files served as image/svg+xml can execute embedded scripts when accessed via their public URLs, enabling persistent attacker-controlled active content and phishing. The attachment storage is on a separate origin, preventing script access to application cookies or session data. This vulnerability is fixed in version 2.2.60.
Malicious packages impersonating popular Arch Linux AUR helpers 'yay' and 'paru' were uploaded to the Arch User Repository (AUR). These trojanized packages contained legitimate code combined with malicious installation scripts that executed remote shell scripts with root privileges. The malicious packages were quickly removed and the uploader banned. Users who installed these packages should assume compromise and take remediation steps.
CVE-2026-61702 is a path traversal vulnerability in OpenPrinting CUPS prior to version 2.4.20. It allows an attacker to use crafted IPP attributes to escape the intended banner directory and cause the scheduler to read arbitrary files accessible via symlinks. The contents of these files can then be copied into a job-sheet spool object and potentially exposed to an attacker-observable endpoint. This vulnerability is fixed in version 2.4.20.
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.
Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.
CVE-2026-55480 is a vulnerability in OpenPrinting CUPS prior to version 2.4.20 where a race condition in the copy_model() function allows a privileged process to follow a symlink and overwrite arbitrary root-writable files. This occurs because a temporary file path is created in a group-writable directory without secure flags, enabling symlink attacks. Exploitation requires an attacker with lp-group write access and a privileged add-printer or modify-printer operation. The issue is fixed in version 2.4.20.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.
bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byte-swapping page_sizes entries. A crafted file can make the loop read and write beyond the heap allocation, and related unvalidated page sizes and cookie_offsets can drive additional out-of-bounds accesses in page and cookie iteration. Applications that parse an attacker-supplied binarycookies file may crash or suffer heap corruption that can potentially enable code execution. This issue is fixed in version 0.1.9.
CVE-2026-55103 is a vulnerability in the discourse-activity-pub plugin for Discourse that allows remote attackers to edit, delete, or reply to federated posts without proper permissions due to insufficient verification of the actor's identity and ownership of the post. This issue was fixed in commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5. The vulnerability has a high severity with a CVSS score of 8.6.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.
## Summary
When cache interception is enabled, `@opennextjs/cloudflare` can interpret percent-encoded paths differently during middleware matching and cache lookup.
An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware.
`enableCacheInterception` is disabled by default.
## Impact
A remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware.
An application is affected when it:
- explicitly enables `enableCacheInterception`;
- relies on middleware for access control; and
- has a matching cached route.
## Details
Middleware matching previously used the encoded request pathname, while cache interception decoded the pathname before selecting a cache entry.
For example, consider an application with:
- middleware matcher `/admin/:path*`;
- middleware returning `401 Authentication required` for `/admin`;
- a statically generated, cached `/admin` route; and
- cache interception enabled:
```ts
export default defineCloudflareConfig({
incrementalCache: staticAssetsIncrementalCache,
enableCacheInterception: true,
});
```
An attacker can request:
```http
GET /%61dmin
```
The encoded pathname does not match `/admin/:path*`, so the authorization middleware is not invoked. Cache interception then decodes `%61dmin` to `admin` and may return the cached `/admin` response:
```http
HTTP/1.1 200 OK
x-opennext-cache: HIT
Protected content
```
Malformed paths exposed an additional inconsistency. For example:
```http
GET /%61dmin/%ZZ
```
The previous implementation decoded each segment independently. It decoded `%61dmin` to `admin` but retained the malformed `%ZZ` segment, allowing cache lookup to continue using a partially decoded pathname.
## Patches
The fix aligns encoded-path handling across middleware matching and cache lookup, and rejects malformed paths instead of partially decoding them. See the upstream fixes in [opennextjs-aws#1199](https://github.com/opennextjs/opennextjs-aws/pull/1199) and [opennextjs-aws#1200](https://github.com/opennextjs/opennextjs-aws/pull/1200).
Users should upgrade to `@opennextjs/cloudflare@1.20.2` or later.
## Workarounds
If upgrading is not immediately possible for an application:
1. Disable cache interception by removing `enableCacheInterception: true`.
2. Enforce authorization inside protected route handlers rather than relying exclusively on middleware.
3. Reject encoded paths for protected routes at a trusted proxy before they reach the Worker.
Adding individual encoded matcher variants is not a complete workaround because pathnames can have multiple equivalent encodings.
A vulnerability in nuxt-modules og-image versions 6.2.5 through 6.6.x allows unauthenticated attackers to inject attacker-controlled image data into the Open Graph image cache by exploiting the dynamic /_og/d/*.png route. This can cause spoofed Open Graph images to be served to users. The issue is fixed in version 6.7.0.
CVE-2026-102631 is an improper authentication vulnerability in Canonical's authd before version 0.7.1. The flaw occurs because authd resolves user identity by broker-scoped provider ID but falls back to username matching without rejecting conflicting non-empty provider IDs. This can cause a new user to inherit the previous user's local UID and home directory if an identity provider reassigns an email address. Consequently, the new user can access and modify files, including sensitive credentials like SSH keys and cloud API tokens, belonging to the previous user. Administrators are advised to lock or delete the previous user's local authd account when the corresponding identity provider account is removed.
CVE-2026-110812 is a vulnerability in Amazon Neptune's implementation of Apache TinkerPop's Gremlin graph-import functionality. It allows an authenticated user with query permissions to submit crafted input that leads to unsafe processing of untrusted data within the query engine. This could result in unintended activity within the query engine environment. AWS recommends upgrading to fixed engine versions to mitigate this issue.
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.
Lychee versions prior to 7.7.0 have a vulnerability where the GET /docs/api endpoint exposes OpenAPI documentation without authentication and regenerates the schema on each request without caching. This allows remote attackers to repeatedly request the endpoint, causing excessive CPU consumption and revealing detailed API schema information. The issue is fixed in version 7.7.0.
Lychee versions prior to 7.7.0 contain an uncontrolled resource consumption vulnerability in the ImagickHandler::loadPdf() function. An authenticated user can upload a crafted PDF with an oversized /MediaBox, causing excessive CPU usage during image processing. This can lead to denial of service by occupying web workers or clogging the image-processing queue. The issue is fixed in version 7.7.0.
CVE-2026-62679 is a path traversal vulnerability in Lychee, a photo-management tool, affecting versions prior to 7.6.4. Under a specific non-default configuration, authenticated users can exploit improper pathname limitation to read files accessible to the web process, including sensitive application configuration and other users' private images. The vulnerability is fixed in version 7.6.4.
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grants_full_photo_access is enabled. This issue is fixed in version 7.6.3.
CVE-2026-61610 is an improper access control vulnerability in Lychee, an open-source photo-management tool. Prior to version 7.6.1, when the photos_star_visibility setting is configured to anonymous, unauthenticated attackers can fetch and modify photos without proper authorization checks. This allows attackers to identify private photos by response differences and change their highlight status, even for photos in private or password-protected albums. The vulnerability is limited to installations using the non-default anonymous star-visibility setting. The issue is fixed in version 7.6.1.