A path traversal vulnerability (CWE-22) exists in zeroturnaround zt-zip versions prior to 1.18.0. The Zips.get(zip).unpack().destination(outputDir).process() API constructs output file paths directly from ZIP entry names without validating that files remain within the intended output directory. This allows crafted ZIP entries with parent-directory traversal sequences to write files outside the designated output directory. The issue is fixed in version 1.18.0.
CVE-2026-44267 is a critical cross-site scripting (XSS) vulnerability in the Elo expression language used by enspirit. Versions prior to 1.0.1 allow attacker-controlled strings to execute arbitrary JavaScript code via the .constructor.constructor property. This flaw affects the defaultFormats.elo.parse() function, the bin/elo CLI, and the elo-lang.org/try playground, enabling browser script execution and session compromise. It also permits arbitrary Node.js code execution in environments using the library. The issue is fixed in version 1.0.1.
CVE-2026-44266 is a critical code injection vulnerability in the Elo expression language used by enspirit. Versions prior to 1.0.1 have a flaw in the Ruby backend where attacker-controlled input is embedded in Ruby double-quoted strings without proper escaping of the # character. This allows Ruby code and shell command execution via Ruby interpolation and backticks in certain code paths. The vulnerability affects the /try playground with Ruby target, the bin/eloc command with Ruby emission, and the defaultFormats.elo.parse() method followed by Ruby emission. The issue is fixed in version 1.0.1.
NetBox versions from 2.9.0 up to but not including 4.7.4 contain an access control vulnerability in the BulkComponentCreateView. Authenticated users with add-component permission can bypass view permissions on parent devices and virtual machines, allowing them to view out-of-scope device details and create components on those devices or VMs. This issue is fixed in version 4.7.4.
CVE-2026-44265 is an improper input validation vulnerability in enspirit elo versions prior to 1.0.1. The vulnerability arises because Elo's programmatic AST API accepts arbitrary values from untyped sources and interpolates them into generated code without runtime syntax validation. This affects multiple fields such as int_literal/float_literal values, variable names, member access properties, object literal keys, datapath segments, lambda parameter names, and SQL let binding names. Exploitation can lead to arbitrary code execution in JavaScript, Ruby, and Python environments, as well as SQL injection in SQL targets. The issue is fixed in version 1.0.1.
## Executive summary
A buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege.
ASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations. Applications are exposed when they enable Brotli decompression or explicitly use Brotli decompression APIs to process attacker-controlled data, as described below. .NET Framework is not affected.
## Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/494
## CVSS Details
- **Version:** 3.1
- **Severity:** High
- **Score:** 8.1
- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`
- **Weakness:** CWE-787 (Out-of-bounds Write)
## Affected Platforms
- **Platforms:** All
- **Architectures:** All
## Mitigations
ASP.NET Core request decompression and HttpClient automatic response decompression are not enabled by default. An application is not exposed merely because an affected .NET package is installed. Exposure requires the application to decompress attacker-controlled Brotli data through one of these paths:
- Enable ASP.NET Core [automatic request decompression](https://learn.microsoft.com/aspnet/core/fundamentals/middleware/request-decompression) with Brotli (`br`) support.
- Enable HttpClient automatic response decompression by configuring [HttpClientHandler.AutomaticDecompression](https://learn.microsoft.com/dotnet/api/system.net.http.httpclienthandler.automaticdecompression) or [SocketsHttpHandler.AutomaticDecompression](https://learn.microsoft.com/dotnet/api/system.net.http.socketshttphandler.automaticdecompression) to include [DecompressionMethods.Brotli](https://learn.microsoft.com/dotnet/api/system.net.decompressionmethods) or `DecompressionMethods.All`.
- Explicitly use Brotli decompression APIs in `System.IO.Compression`, such as `BrotliStream` or `BrotliDecoder`.
Until the update can be deployed, avoid decompressing attacker-controlled Brotli data.
The following examples show how to disable Brotli decompression if you are already using it.
> **Warning: Do not use these code snippets if you are not already using decompression.** Do not introduce a call to `AddRequestDecompression` if your application does not already call it. Similarly, do not introduce an `AutomaticDecompression` property assignment if your application does not already set that property. Modify only your existing decompression configuration. Enabling automatic decompression can introduce denial-of-service risks even when Brotli is excluded.
If you are already using Brotli request decompression in ASP.NET Core, exclude it by removing the `br` entry from your existing decompression configuration. This retains the default gzip and deflate providers:
```csharp
builder.Services.AddRequestDecompression(options =>
{
options.DecompressionProviders.Remove("br");
});
```
If your application already enables HttpClient automatic response decompression, disable Brotli by updating the flags on your existing handler so they do not include `DecompressionMethods.Brotli`:
```csharp
var handler = new HttpClientHandler
{
AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate
};
var httpClient = new HttpClient(handler);
```
Applications that directly use Brotli decompression APIs must stop passing untrusted Brotli data to those APIs until updated. Ensure that other application code does not continue to decompress the same untrusted Brotli data. These changes can affect normal request and response handling and should be tested before deployment. Installing the security update remains the recommended fix.
## <a name="affected-packages"></a>Affected Packages
The vulnerability affects .NET applications using an affected Brotli decoder in the runtime or NativeAOT packages listed below.
### .NET 8
Package name | Affected version | Patched version
------------ | ---------------- | ---------------
[Microsoft.DotNet.ILCompiler](https://www.nuget.org/packages/Microsoft.DotNet.ILCompiler) | >= 8.0.0, < 8.0.33 | 8.0.33
[Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33
[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33
[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64) | >= 8.0.0, < 8.0.33 | 8.0.33
[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33
[Microsoft.NETCore.App.Runtime.NativeA
### Impact
A remote Telegram user can write files to arbitrary paths inside an agent's persistent workspace volume (`praktor-wk-<workspace>`, mounted at `/workspace/agent`), escaping the documented `uploads/` directory.
The attacker controls the Telegram document filename, which was concatenated into the destination path without sanitization (`internal/telegram/bot.go`, at both upload sites) and resolved with `path.Join`, which collapses `../` sequences. A filename like `../../../CLAUDE.md` resolved to the root of the agent workspace volume, outside `uploads/`.
Because the agent workspace is the persistent working directory the Claude agent reads from and operates on across runs, writing outside `uploads/` lets an attacker plant or overwrite files the agent later consumes — e.g. `CLAUDE.md`, agent instruction/skill/hook files, or other config under `/workspace/agent`. This turns a file upload into a stored injection into the agent's instruction/execution surface (CWE-22 path traversal escalating to stored instruction injection).
### Reachability
By default the bot has no user allowlist (`allow_from: []` means "allow all"), so the only precondition is that a user can message the bot. No authentication or prior privilege is required.
### Affected versions
Through `v0.9.0` (and HEAD `3902d29`).
### Patched versions
`v0.9.1`, containing PR #228.
### Workarounds
Restrict `telegram.allow_from` to trusted user IDs to limit who can send uploads to the bot. Upgrading to `v0.9.1` is the recommended fix.
### Fix (defense in depth)
- `internal/telegram/bot.go`: apply `path.Base()` to the attacker-controlled filename at both upload sites, stripping directory components and `..`.
- `internal/container/manager.go`: `WriteVolumeBytes` now rejects any path that escapes `/vol` after `path.Join`, protecting future callers.
### Credit
Reported privately by [tonghuaroot](https://github.com/tonghuaroot), who provided a detailed root-cause analysis, a deployed end-to-end proof of concept against the real `container.Manager`, and fix verification.
### Description
A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.
CVE-2026-121263 is a path traversal vulnerability in the phpMyAdmin MoTranslator component affecting versions 6.0.0 and 6.0.1. The flaw exists in the Loader::getTranslator function, where manipulation of the locale argument can lead to unauthorized file path access. The vulnerability can be exploited remotely without user interaction. Public exploit code has been disclosed, but the vendor has not responded or provided a fix.
CVE-2026-121628 is a race condition vulnerability in Bagisto versions before 2.3.16 and 2.4.1 that allows attackers to redeem single-use coupons multiple times by submitting concurrent order requests. This flaw exists in the manageCartRule() function and affects the onepage orders checkout endpoint, bypassing usage checks on coupons.
Buku versions 5.0 through 5.1.1 contain a stored cross-site scripting (XSS) vulnerability in the bukuserver bookmark list. This flaw allows attackers to inject malicious scripts via an unescaped bookmark URL, which can be submitted through the unauthenticated /api/bookmarks endpoint. Exploitation enables attackers to execute scripts in the context of the victim's browser, potentially issuing same-origin API requests with the victim's credentials.
GNU Gatekeeper (gnugk) versions before 5.16 have an out-of-bounds read vulnerability in the H46024Socket::ReceivedProbePacket() function. This flaw allows remote attackers to cause a heap over-read by sending short probe packets, specifically short application-defined RTCP packets during H.460.24 probing. Exploitation may lead to reading beyond allocated heap memory and potentially crashing the gatekeeper.
GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.
Nanosystems Supremo versions before 5.0.2.3874 for Windows and macOS have an improper certificate validation vulnerability. This flaw allows attackers on the same network to intercept TLS connections by using self-signed certificates. Exploitation can lead to exposure of usernames, SHA-256 password hashes, and license codes. The vulnerability is fixed in version 5.0.2.3874.
Lightdash versions from 0.2609.0 up to but not including 3.137.0 have an authorization bypass vulnerability in the RenameService. Authenticated users with update Project permission on one project can access and modify dashboards of other projects due to improper verification of project identifiers. This allows attackers to modify dashboard filters and break charts or read field metadata from unauthorized projects. The vulnerability is fixed in version 3.137.0.
CVE-2026-119509 is a missing authorization vulnerability in the eranfl ClickCease Click Fraud Protection plugin affecting versions prior to 3.3.1. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity with a CVSS score of 5.3 and was fixed in version 3.3.1.
CVE-2026-97072 is a missing authorization vulnerability in the myCred plugin affecting versions prior to 4.0.3. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 4.0.3.