Page 3
A critical SQL injection vulnerability was discovered in `MangosSuperUI/Scripts/discover_relationships.py`, where database, table, and column names were interpolated directly into SQL queries using Python f-strings. An attacker controlling these input parameters could execute arbitrary SQL against the database. The fix applies backtick escaping for identifier names and parameterized queries for the `LIMIT` clause.
A Server-Side Request Forgery (SSRF) vulnerability in `offscreen.js` allowed attackers to supply malicious feed URLs that the browser extension would fetch without validation, potentially exposing internal network services including cloud metadata endpoints. The fix introduces a dedicated `validateFeedUrl` utility and disables automatic redirect following, closing the attack vector before requests leave the extension. This kind of vulnerability is especially dangerous in browser extensions becau
A Dependabot configuration in `.github/dependabot.yml` was missing a `cooldown` block, meaning dependency updates could be proposed immediately after a new package version was published — including potentially malicious or unstable releases. Adding a `cooldown` with `default-days: 7` ensures a 7-day waiting period before Dependabot opens pull requests for newly published versions, giving the security community time to detect and flag compromised packages.
A critical command injection vulnerability (CVE-2026-9277) was discovered in shell-quote 1.8.3, where unescaped line terminators in parsed shell arguments could allow attackers to inject and execute arbitrary commands. The fix upgrades shell-quote to version 1.8.4 and pins the resolution in both `package.json` and `yarn.lock` to ensure the patched version is used across the entire dependency tree. Because this package is used in a production web application that processes user-influenced input,
CVE-2026-59873 is a critical Denial of Service vulnerability in the node-tar package, where a specially crafted gzip bomb can exhaust server resources during archive extraction. The fix upgrades tar from version 7.5.16 to 7.5.22 (pinned at `^7.5.19`) in the `@xen-orchestra/backups` package, closing the attack surface against resource exhaustion attacks targeting backup workflows.
A Dependabot configuration in `.github/dependabot.yml` was missing a `cooldown` block, meaning dependency update PRs could be opened immediately after a new package version was published — including potentially malicious or compromised packages. Adding a `cooldown: default-days: 7` setting ensures updates are only proposed after a 7-day waiting period, giving the security community time to identify and flag bad packages before they reach your codebase.
A Node.js library's `.github/dependabot.yml` was configured to automatically propose dependency updates without any cooldown period, meaning a freshly published — potentially malicious or unstable — package version could be surfaced as a PR within minutes of release. By adding a `cooldown` block with `default-days: 7` to each of the three `package-ecosystem` entries (GitHub Actions, npm, and Composer), the project now waits one week before suggesting any new package version. This single configur
A critical Denial of Service vulnerability (CVE-2026-59873) was discovered in node-tar versions prior to 7.5.19, allowing attackers to craft malicious gzip archives that expand to consume excessive memory or CPU, crashing the host process. The fix upgrades the `tar` dependency from 7.5.16 to 7.5.19 in both `package.json` and `package-lock.json`, closing the attack surface for any application that processes user-supplied or remotely fetched archives.
A critical SSRF vulnerability in `js/cd-player/playlist-importer.js` allowed attacker-controlled URLs from third-party Meting APIs to be stored and later fetched by users' browsers, potentially exposing internal network resources. The fix introduces an `isSafeUrl()` validation function that enforces HTTPS-only URLs before any track audio or cover art URL is accepted into the application. This change closes the attack path without altering the normal playlist import workflow.
A Dependabot configuration in `.github/dependabot.yml` was missing a `cooldown` block, meaning it would immediately propose updates to newly published package versions — including potentially malicious or unstable ones. Adding a `cooldown` with `default-days: 7` ensures the project waits one week before acting on new releases, giving the security community time to identify and flag compromised packages. This is especially critical for a Node.js library whose vulnerabilities cascade to all downst
A critical authentication bypass vulnerability was discovered in `backend/services/auth-state.js` where the `tokenTtlSeconds()` function used `jwt.decode()` instead of `jwt.verify()`, allowing attackers to forge JWT tokens with arbitrary claims. Because `jwt.decode()` never validates the cryptographic signature, any attacker could craft a token with a manipulated expiration time or elevated privileges and have it accepted as legitimate. The fix replaces the insecure decode call with `jwt.verify(
A critical authentication bypass was discovered in `JwtExtractor.java` where `JWT.decode()` was used instead of a proper signature-verifying method, allowing any attacker to forge a JWT with an arbitrary username — including `admin` — and gain unauthorized access. The fix adds clear documentation establishing the trust boundary: signature validation must occur upstream, and the extracted claims are for display purposes only. This change prevents the class from being misused as an authorization g