•about 2 hours ago•GHSA-7PPR-R889-MCF2
7.5GHSA-7PPR-R889-MCF2: Unbounded WebSocket Message Aggregation in http4s-blaze-server leads to Denial of Service
An uncontrolled resource consumption vulnerability exists in the Scala-based http4s-blaze-server package of the http4s/blaze library. The vulnerability allows remote, unauthenticated attackers to cause an Out of Memory Error (OOM) and JVM crash by streaming a continuous sequence of small or empty WebSocket continuation frames with the FIN bit set to 0. This bypasses typical payload size checks because of the JVM's per-object allocation overhead, leading to rapid heap exhaustion with minimal network bandwidth.
5 views•5 min read
•about 3 hours ago•GHSA-95CV-R8X4-VH75
7.6GHSA-95cv-r8x4-vh75: Path Traversal Vulnerability in OpenList Batch Rename Handler
A critical path traversal vulnerability has been identified in the OpenList Go-based backend package. The vulnerability exists within the batch rename handler because the application does not validate the source filename parameter before constructing filesystems paths. This omission allows authenticated users to escape their designated directory and rename files in sibling paths.
6 views•7 min read
•about 4 hours ago•GHSA-P6PH-3JX2-3337
4.3GHSA-P6PH-3JX2-3337: Horizontal Privilege Escalation and Metadata Information Disclosure via Bleve Search in OpenList
OpenList version 4.2.3 and prior is vulnerable to an authorization bypass and metadata leakage. When configured with the Bleve search engine backend, OpenList fails to perform separator-aware path matching when validating tenant containment. This allows authenticated users to access sibling directories sharing similar name prefixes. Furthermore, the search backend returns unfiltered global result counts, leaking existence verification data of unauthorized files via side-channel analysis.
6 views•5 min read
•about 5 hours ago•GHSA-86CX-WWF4-PHQ4
6.5GHSA-86cx-wwf4-phq4: Path Prefix Confusion Authorization Bypass in OpenList
An authorization bypass vulnerability in OpenList version 4.2.3 and below allows authenticated users to read arbitrary files outside of their designated base directories due to an insecure path prefix check using Go's standard strings.HasPrefix function.
5 views•6 min read
•about 6 hours ago•CVE-2026-16584
7.0CVE-2026-16584: Security Policy Bypass in AWS API MCP Server via Startup Initialization Failure
A security policy bypass vulnerability exists in the AWS API MCP Server (awslabs-aws-api-mcp-server) from version 0.2.13 through 1.3.46. When the server fails to load the read-only operations index during startup (due to transient network failures, file permission issues, or other exceptions), it logs a warning but continues running in an insecure, degraded state. Under this condition, the security policy engine fails open, silently skipping all subsequent security checks and consent prompts for the lifetime of the process. This permits unauthorized mutating AWS CLI commands to execute via indirect prompt injection attacks.
6 views•7 min read
•about 7 hours ago•GHSA-6V4M-FW66-8R4X
6.5GHSA-6V4M-FW66-8R4X: Path Disclosure and Shell Expansion Bypass in Shescape
An incomplete escaping vulnerability in the npm package 'shescape' allows unauthenticated users to trigger dynamic shell expansions, absolute path disclosure, and command block break-outs on Unix and Windows systems.
6 views•7 min read
•about 8 hours ago•GHSA-W4HW-QCX7-56PR
9.2GHSA-W4HW-QCX7-56PR: OS Command Injection in Shescape via Unescaped Parentheses on Windows CMD
A critical command injection vulnerability in the shescape npm library affects Windows systems when running shell commands using cmd.exe. The escaping function fails to neutralize parentheses, allowing attackers to close shell blocks and execute arbitrary commands.
12 views•5 min read
•about 9 hours ago•GHSA-Q53C-4PRM-W95Q
6.3GHSA-q53c-4prm-w95q: Unix Home Directory Path Disclosure and Command Escaping Flaws in Shescape
An escaping bypass in the npm package shescape on Unix platforms utilizing the Dash shell can result in unauthorized home directory path disclosure. The vulnerability occurs when user input containing specific sequences is passed inside shell variable assignment contexts. Additionally, the patch addresses secondary security gaps related to Zsh extended globbing and Windows CMD command block breakouts.
7 views•6 min read
•about 10 hours ago•GHSA-GM3R-Q2WP-HW87
8.7GHSA-gm3r-q2wp-hw87: Quadratic-Time Denial of Service via Flag-Protection in Shescape
A high-severity algorithmic-complexity vulnerability in the Node.js library Shescape leads to a Quadratic-Time Denial of Service (DoS) when flag protection is enabled. By supplying inputs containing repetitive control characters and hyphens, remote attackers can trigger an inefficient nested loop in Shescape's argument-composition logic, blocking the Node.js single-threaded event loop and causing total application Denial of Service.
6 views•7 min read
•about 11 hours ago•GHSA-FP43-VJ7G-PG92
7.5GHSA-FP43-VJ7G-PG92: Multi-Vector Security Vulnerabilities in OmniFaces JSF Utility Library
A multi-vector vulnerability advisory in the OmniFaces JavaServer Faces (JSF) utility library covers flaws leading to unauthenticated arbitrary file access, memory exhaustion (DoS), cross-site scripting (XSS), and WebSocket push channel hijacking.
7 views•5 min read
•about 12 hours ago•GHSA-FWJX-9P69-H25H
6.3GHSA-FWJX-9P69-H25H: Terminal Escape Sequence Injection in Oh My Posh
Oh My Posh prior to version 29.35.1 is vulnerable to terminal escape sequence injection. Dynamic strings from directory names or Git repository metadata are written to the prompt output without neutralization, enabling unauthenticated remote code execution, clipboard hijacking, or terminal DoS when users navigate to malicious folders.
7 views•8 min read
•about 13 hours ago•GHSA-6XJ8-QV9J-XCJQ
7.8GHSA-6XJ8-QV9J-XCJQ: Arbitrary Command Execution via Template Injection in Oh My Posh
A critical-severity template injection vulnerability in Oh My Posh allows for unauthenticated arbitrary command execution. This issue occurs when a user navigates their shell into a directory whose name contains malicious Go template syntax, which is subsequently parsed and executed by the prompt engine.
6 views•6 min read