A path traversal vulnerability (CWE-22) exists in tensorchord envd versions from 0.3.38 up to but not including 1.3.6. The issue occurs in the install.python_packages(requirements=...) function, where insufficient containment allows reading files outside the intended build context. An attacker who can influence build inputs may cause unauthorized file contents to appear in debug logs or build metadata, limited by envd process permissions. Exploitation in version 1.3.5 requires concurrent filesystem modifications. The vulnerability is fixed in version 1.3.6.
CVE-2026-124679 is an authentication bypass vulnerability in Apache APISIX versions 3.18.0 through 3.19.0. It occurs when routes use jwe-decrypt with strict mode disabled and a forward_header different from the token header, allowing unauthenticated clients to spoof decrypted plaintext values. A similar bypass can happen if forward-auth is configured with allow_degradation set to true and the authentication service is unavailable. The issue is fixed in version 3.20.0.
CVE-2026-124716 is an incorrect authorization vulnerability in Apache APISIX versions 1.4.0 through 3.19.0. An authenticated user with any one of a route's required permissions or scopes can access the protected upstream without needing all required permissions, including HTTP methods that should be denied by the authorization server. This issue is fixed in version 3.20.0.
Indico versions prior to 3.3.14 contain a relative path traversal vulnerability that allows a malicious event manager to read any local file accessible by the Indico server user when building an offline copy of an event. This vulnerability has been fixed in version 3.3.14.
CVE-2026-124666 is an authentication bypass vulnerability in Apache APISIX affecting versions 3.8.0 through 3.19.0. The flaw occurs when multi-authentication falls back from wolf-rbac to another authenticator, allowing client-supplied Wolf identity headers to persist in the request. This can cause downstream services relying on these headers to receive an incorrect identity. The issue is fixed in version 3.20.0.
Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX.
An unauthenticated client can reach upstream paths protected
by a route-level auth plugin when a route without auth exists on the
same upstream and the upstream does not collapse encoded dot segments.
This issue affects Apache APISIX: from 0.9 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Authentication bypass by spoofing vulnerability in Apache APISIX.
When a Route's configured headers carry a caller identity and the OpenAPI document declares
the same header, a caller can act as another identity against the
upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
The PyPI package 'testing1345' version 0.1.0 contains malicious code that executes during installation. It downloads and runs a remote script, which may vary between benign and malicious payloads. The final payload is a Remote Access Trojan (RAT), enabling unauthorized control of the infected system.
Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX.
With match_uri_encoded_slash enabled and skip_mtls_uri_regex
configured, a client without a certificate can reach an upstream
behind a route that requires one, limited to request paths that decode
to an exempted URI. This issue affects Apache APISIX: from 3.18.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.
A caller of the MCP endpoint can invoke endpoints the OpenAPI document
never declared, under the declared tool's HTTP method, using the credentials the
Route adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
GLPI versions from 9.5.0 up to but not including 10.0.27, and from 11.0.0 up to but not including 11.0.9, contain an improper access control vulnerability. Authenticated users could access ITIL followups, tasks, or solutions derived from templates without proper read-permission checks on the parent ticket, problem, or change. This could lead to unauthorized disclosure of information from parent items. The issue is fixed in versions 10.0.27 and 11.0.9.
Nuxt versions from 4.6.0 up to but not including 4.6.4 have a URL interpretation conflict where request paths starting with // are parsed differently by Nuxt and Nitro server components. This discrepancy allows unauthenticated requests like //x/admin to bypass route-scoped server handlers, middleware path checks, redirects, and security headers configured for the /admin route. The issue is fixed in version 4.6.4.
CVE-2026-128076 is a low-severity vulnerability in the @nuxt nitro-server framework affecting versions from 3.21.6 up to but not including 4.0.0 and from 4.4.6 up to but not including 4.6.4. It involves improper encoding or escaping of output in the /__nuxt_island path hash, which uses ohash serialization that does not escape quotes in string values or delimiters in object keys. This flaw allows different island-prop tuples to produce the same path, potentially leading to content substitution or script execution if unsafe HTML sinks like v-html or innerHTML are used. The issue is fixed in version 4.6.4.
A vulnerability in Nuxt versions from 3.0.0 up to but not including 4.6.4 causes sensitive information to be exposed in error messages during server rendering. Non-HTTP errors are wrapped and treated as deliberately exposed errors, leading to disclosure of original error messages and data such as upstream fetch URLs, query-string secrets, response bodies, and database hosts. This exposure occurs in the error page payload and JSON error responses, regardless of custom error page rendering. The issue is fixed in version 4.6.4.
A regular expression inefficiency in Nuxt versions 4.6.0 through 4.6.3 causes the Node.js event loop to be synchronously blocked by long runs of slash characters in certain URL paths. This affects server-side rendering when using isr, swr, cache route rules, or the experimental early-404 feature, leading to availability delays. Fully prerendered or client-only applications and those not using the specified route rules or features are not impacted. The issue is resolved in version 4.6.4.
A vulnerability in Nuxt development middleware versions from 3.0.0 and 3.12.2 up to but not including 4.6.4 allows an attacker to bypass origin validation under specific conditions. This issue arises when the Host header names an attacker-controlled hostname, which after DNS rebinding resolves to a loopback address. An attacker can then access client JavaScript chunks and inline source maps, potentially exposing compiled source code, local filesystem paths, and developer-controlled values. The vulnerability requires the attacker to know or guess the development server port and trick the developer into opening a malicious page. The default Vite builder and production builds are not affected. The issue is fixed in Nuxt version 4.6.4.
A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local paths as root, allowing a local attacker to disclose privileged content and to deny service via disk exhaustion.
A vulnerability in Nuxt versions from 3.0.0 up to but not including 4.6.4 allows an unauthenticated request to bypass certain route rules due to inconsistent handling of encoded slashes (%2F) in request paths. This leads to incomplete application of redirect, headers, proxy, SSR, and other route rules for decoded paths in multi-segment or catch-all routes. The issue is fixed in version 4.6.4.
CVE-2026-129139 is a vulnerability in the itwanger paicoding product where accounts created via ZSXQ login use predictable credentials. The username and password are both derived solely from the member's ZSXQ number, which can be read by unauthenticated attackers from the victim's profile page. This allows attackers to compute the credentials and log in to the victim's account without authentication.
paicoding versions 1.0.0 through 1.0.3 have a stored cross-site scripting (XSS) vulnerability in the image upload functionality. The vulnerability arises because the ImageServiceImpl.validateStaticImg method accepts SVG files that can contain embedded scripts. When these SVG images are stored locally and served from the site origin, authenticated attackers can upload malicious SVGs that execute scripts in the context of other users viewing them. This can lead to theft of non-HttpOnly session cookies and account hijacking.