Cocos AI's intra-handshake attested TLS implementation is vulnerable to a Time-Of-Check to Time-Of-Use (TOCTOU) attack. An attacker who can modify the attested workload's code, memory state, or configuration after the initial attestation but without terminating the TLS connection can cause the peer to continue trusting a stale attestation state. This vulnerability affects long-lived TLS connections because attestation is only performed once at connection establishment, with no mechanism for re-attestation during the connection lifetime. The issue was discovered through formal analysis and affects versions prior to 0.9.0.
A path traversal vulnerability exists in the Dagu MCP DAG specification read functionality (CVE-2026-102943) prior to version 2.11.0. The vulnerability arises because a traversal fix applied as HTTP middleware does not apply to in-process API calls made by the MCP service, allowing arbitrary YAML file reads with a viewer-role key. The flaw bypasses path containment and workspace isolation checks, enabling read-only access to .yaml/.yml files outside intended directories. The issue is confirmed at the HEAD commit after version 2.10.7 and fixed in version 2.11.0.
A vulnerability in the gopacket library's SCTP protocol decoder allows crafted SCTP segments to cause runtime panics due to out-of-bounds slice reads. This occurs because sub-decoders for SCTP chunk types do not validate chunk lengths against required minimums, leading to crashes when processing malicious input. The issue affects all released versions through v1.7.1 and the current master branch. It was fixed in version 1.7.2 by adding proper length checks in the sub-decoders, preventing panics and returning decode errors instead.
Kubeflow Pipelines frontend versions prior to 2.15.0 contain a reflected cross-site scripting (XSS) vulnerability in the pod information and pod events error responses. The vulnerability arises because untrusted pod names and namespaces are reflected in HTML error messages without proper validation, allowing an attacker to craft links that execute JavaScript in the frontend's origin when visited by an authenticated user. Exploitation requires the victim to follow a malicious link and meet the deployment's authentication and route access controls. The vulnerability does not enable server-side code execution or guaranteed cookie theft. The issue was fixed in version 2.15.0 by validating resource names and sanitizing error responses.
Kubeflow Pipelines API server versions before 0.0.0-20260403210607-ac3a4c65677a contain a SQL injection vulnerability via unvalidated SQL identifier fields decoded from the page_token pagination parameter. This allows an authenticated attacker with access to list APIs to read database data accessible to the API server, potentially including data from other namespaces. The vulnerability affects pipeline-listing and run-listing APIs. A fix is available in version 0.0.0-20260403210607-ac3a4c65677a and later.
Kubeflow Pipelines in multi-user mode had an authorization bypass vulnerability allowing any authenticated user to modify or delete shared/global pipelines without proper Kubernetes RBAC permissions. This flaw affected write and delete operations on pipelines with an empty namespace. The issue was fixed in version 0.0.0-20260420170029-186dd1f3b040. Unauthorized modifications could compromise pipeline integrity and unauthorized deletions could disrupt availability. Reading shared pipelines was always allowed and remains so after the fix. The vulnerability does not directly enable code execution but could lead to attacker-controlled workload behavior if a modified pipeline is executed.
The Kubeflow Pipelines API server allowed fetching pipeline package URLs supplied by callers without validating the destination host. This enabled authorized users to trigger requests from the API server's network position, potentially accessing internal services otherwise unreachable. The vulnerability is a server-side request forgery (SSRF) with limited information disclosure via status codes but no demonstrated arbitrary data or credential theft. The issue was fixed in version 0.0.0-20260517162502-504d7797c1e0 by enforcing strict URL validation and network restrictions.
Kubeflow Pipelines V1/raw-Argo execution cache does not separate cached results by Kubernetes namespace, allowing tenants sharing the cache service to read or substitute cached outputs across namespaces. This cross-tenant cache key collision impacts confidentiality and integrity of cached step outputs but does not enable arbitrary code execution. The issue affects multi-tenant deployments using the legacy cache service with cache-enabled V1/raw-Argo steps. A fix was merged and released in version 2.18.0.
Croc is a peer-to-peer file transfer tool that has a vulnerability allowing an attacker to bypass the overwrite confirmation prompt on the receiving side by using filenames starting with 'croc-stdin-'. This bypass enables silent overwriting, truncation, or replacement of existing files, including symlink substitution, without user confirmation. The flaw arises because the overwrite prompt is suppressed based solely on the filename prefix rather than the transfer type, allowing any sender to exploit this behavior. The issue affects multiple versions prior to 11.5.2 and was introduced by a design decision to avoid prompts for croc's internal text-transfer artifacts. A fix is available in version 11.5.2.
A vulnerability in the Untar function of github.com/ddev/ddev prior to version 1.25.4 allows an attacker to overwrite arbitrary host files via crafted tar archives containing absolute symlink targets. The flaw arises because the symlink target validation rebases absolute paths into the extraction directory for checking but creates symlinks using the raw absolute target, enabling escape from the intended extraction directory. This can lead to overwriting critical files such as shell rc-files, potentially resulting in remote code execution.
Velociraptor versions up to 0.77.1 contain a vulnerability in the sql() VQL plugin that allows low-privilege analyst users to read arbitrary server files. The plugin executes SQL queries without enforcing required permissions, enabling attackers to exploit MySQL's LOAD DATA LOCAL INFILE feature to exfiltrate sensitive files such as private keys and password hashes.
A critical authorization bypass vulnerability exists in the Kubeflow Pipelines API server's HTTP multipart upload endpoints when operating in multi-user mode with the default configuration. The API server does not perform authorization checks for pipeline uploads targeting the empty namespace, which is used for shared, cluster-wide pipelines. This allows low-privilege or unauthenticated users to create or modify shared pipelines, potentially injecting malicious pipeline versions that other tenants execute. The vulnerability arises because the authorization helper skips SubjectAccessReview for empty namespaces, contrary to intended behavior confirmed by the gRPC sibling code. A fix is available in version 0.0.0-20260909234119-62516d8c525f.
An authenticated Pocket ID user can exploit a flaw where an email verification token remains valid after changing the account email address. The token is bound only to the user ID, not the email address, allowing the attacker to verify an email address they do not control. This leads to the system marking the new email as verified without proof of control. Consequently, relying parties that trust the verified email claim in OIDC can be tricked into linking the attacker's identity to a victim's account, enabling cross-application account takeover.
The esm.sh web.NewHandler static file server allows unauthenticated attackers to read arbitrary files outside the configured application directory by using URL-encoded dot-segment path traversal sequences such as %2e%2e. The handler joins the decoded request path directly with the application directory path without verifying that the resulting path remains within the intended directory, enabling directory traversal. This vulnerability affects versions prior to 0.2.0 and has a CVSS 3.1 score of 7.5 (high severity). A fix is available in version 0.2.0.
Telepresence's Traffic Manager gRPC API on port 8081 lacks authentication, allowing any pod with network access to register as a client in any managed namespace. This enables the pod to intercept services in namespaces without Kubernetes RBAC permissions, exfiltrating the victim pod's full container environment including secrets and tokens. The vulnerability affects versions prior to 2.31.0 and is fixed in version 2.31.0.
The Telepresence Traffic Manager's Tunnel gRPC streaming endpoint accepts a client-supplied session ID without verifying ownership. An attacker who knows a valid active session ID can gain full network routing capabilities of that session. Session IDs are UUID4, making brute force difficult, but session IDs can be leaked or obtained internally. The vulnerability affects versions prior to 2.31.0 and is fixed in 2.31.0.
A vulnerability in github.com/mayswind/ezbookkeeping allows remote attackers to bypass source-IP allowlists configured for MCP and API token access by sending a spoofed X-Forwarded-For header. The application uses the Gin framework without setting trusted proxies, causing it to trust the attacker-supplied header as the client IP. This bypasses IP-based access controls and causes audit logs to record the spoofed IP instead of the attacker's real IP, undermining non-repudiation. The issue affects versions from 0.10.0 up to but not including 1.6.0 and is fixed in version 1.6.0.
Remark42 versions prior to 1.16.2 unconditionally trust client-supplied IP headers (True-Client-IP, X-Real-IP, X-Forwarded-For) without verifying the request source is a trusted proxy. This allows attackers to spoof their IP address, bypassing per-IP rate limits and other per-IP controls such as comment rate limiting, vote de-duplication, and anonymous identity derivation. The issue affects deployments directly exposed to the internet or those behind proxies that forward attacker-controlled headers without proper filtering. The vulnerability is fixed in version 1.16.2, but requires explicit configuration of the --trusted-proxy option to enforce header trust restrictions.
The Pocket ID client credentials grant implementation does not validate the requested resource parameter before embedding it as the audience (aud) claim in issued JWT access tokens. This allows any authenticated OIDC client to obtain tokens claiming authorization for arbitrary audiences, including other registered clients, without authorization checks. The introspection endpoint cannot detect misuse because it trusts the aud claim controlled by the requester. This vulnerability breaks audience-based access controls in deployments relying on Pocket ID for service-to-service authorization.
A privilege escalation vulnerability exists in traQ's OAuth2 implementation during silent authorization with the prompt=none parameter. When the scope parameter is empty or omitted, the system incorrectly allows issuance of access tokens with all registered scopes for the OAuth client, bypassing user consent for those scopes. This can enable an attacker controlling an OAuth client to obtain broader access than authorized. The issue is fixed in version 1.0.0-rc.2.0.20260629134940-5510fe8aa9bb.