Advisory Catalog

showdown allows stored cross-site scripting through table header ID injection

Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write

Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

9router: Login brute-force protection bypass via spoofed X-Forwarded-For header

9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover

Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint

Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879

9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats

showdown metadata title handling allows cross-site scripting

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

vLLM denial of service via prompt embeds on M-RoPE models

vLLM has Remote DoS via Invalid Recovered Token Reinjection

Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing

Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command

Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component

Coder's AI Bridge Proxy skips TLS certificate verification in default configuration

Suspended Coder users retain access to AI Bridge LLM proxy endpoints

Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints

Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

Coder's sub-agent app registration bypasses template port-sharing policy enforcement

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service

Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

Coder: User-admin role can reset owner account password

Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check

Langroid: handle_message() executes user-supplied tool JSON without sender verification

Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases

Decompress: Archive extraction can create files and links outside of the target directory

vLLM: Speech-to-text upload size limit is enforced after full UploadFile read

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading