Advisory Catalog

rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys

rclone: Path traversal in serve s3 allows reading and overwriting root-level files

rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic

rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

rclone: Incomplete path validation allows backend root escape in serve restic

rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote

rclone: Verbose Stack Trace Disclosure in RC API Error Responses

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message

Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

sigstore-go fails to check signature timestamps against a signing key's validity period

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Wings exposes node configuration secrets through egg configuration-file templating

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

netfoil: Incorrect block responses could lead to localhost traffic

Logging operator has Fluentd configuration injection that allows remote code execution

ZITADEL Users Can Self-Verify Email/Phone via API

prebid-server's request forgery vulnerability allows for possible host environment data extraction

goshs has ACL Bypass & Path Traversal

openhole-server vulnerable to path traversal via URL-decoded request path

td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

goshs has a Path Traversal issue

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape

Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory

Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress

Out-of-bounds read and panic in ReadDir in github.com/cloudsoda/go-smb2 and github.com/hirochachacha/go-smb2

Uncatchable stack-overflow denial of service in rsc.io/pdf

Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop