Contributions

CVEs, advisories, pull requests, issues, and other open-source contributions.

total: 27
projects: 9
cve + advisory: 11

❯ breakdown

type:

❯ 27 of 27 contributions

~CVE-2026-74035

CVEPublished

wazuh/wazuh

An empty password bypasses both the password policy and the reserved user guard in security.update_user

update_user kept the length check, the complexity check and the reserved-user guard behind an if password: block, and an empty string is falsy in Python, so all three were skipped. The ORM had no reserved-ID check of its own, so a delegated user administrator could blank the password of the wazuh superuser and sign in as it over basic auth. CVSS 7.2, fixed in 4.14.8.

pythonsecurityprivilege-escalationcwe-269

$ October 2026open ↗

~CVE-2026-93346

CVEPublished

wazuh/wazuh

API brute-force protection is still bypassable by concurrent login requests

An earlier fix put the per-IP failed-login counter behind a lock, which made its updates atomic but left the window between the block check at the start of a request and the failure only counted after credential validation. Concurrent requests all clear the check before any failure lands, so max_login_attempts stops applying; a local simulation put 100 of 100 parallel attempts through a limit of 5. CVSS 5.3, fixed in 4.14.8.

pythonsecurityrace-conditioncwe-307

$ October 2026open ↗

~GHSA-r4xp-prcw-77qf

AdvisoryPublished

better-auth/better-auth

OAuth Proxy lets an attacker sign in as another user

The OAuth Proxy plugin trusted any profile it could decrypt, and with a cookie state store it shared a secret with sign-in state that carries caller-chosen data. An attacker who knew a user's email could forge a profile and sign in as them. CVSS 7.4, fixed in 1.7.7.

typescriptsecurityauthenticationcwe-287

$ September 2026open ↗

~#932

PROpen

apple/containerization

Stop filling the disk when pulling images with oversized blobs

Blob downloads accepted a Content-Length larger than the descriptor and never compared the bytes actually received against it, so the write never stopped. Downloads are now bounded by the descriptor size and an oversized body is refused before anything lands on disk. Credited as reporter.

swiftsecurityresource-exhaustionoci

$ September 2026open ↗

~#931

PROpen

apple/containerization

Stop leaking disk space when unpacking images with zstd layers

Uncompressed zstd layers were written to temp directories with no size limit, and those directories were left behind when decompressing a later layer failed or was cancelled. zstd layers now stream through decompression, so no copy is written to disk. Credited as reporter.

swiftsecurityresource-exhaustionzstd

$ September 2026open ↗

~#38692

PRMerged

wazuh/wazuh

Sanitize the Fluentd server strings written to the log

The fluent-forward module logged three strings straight from the collector — the PONG rejection reason and server hostname, and unexpected HELO keys — without filtering, so a rogue collector could embed CRLF and forge entries in ossec.log. Credited as reporter.

csecuritylog-injectioncrlf

$ September 2026open ↗

~CVE-2026-105801

CVEPublished

openapi-generators/openapi-python-client

Malicious OpenAPI documents can cause arbitrary code generation, executed when anyone imports the generated client

The generator interpolated strings from an OpenAPI document into its Jinja templates without escaping, so a crafted document could break out of a literal and write arbitrary Python into the generated client, which then runs on import. CVSS 8.4, fixed in 0.29.1.

Contributions

An empty password bypasses both the password policy and the reserved user guard in security.update_user

API brute-force protection is still bypassable by concurrent login requests

OAuth Proxy lets an attacker sign in as another user

Stop filling the disk when pulling images with oversized blobs

Stop leaking disk space when unpacking images with zstd layers

Sanitize the Fluentd server strings written to the log

Malicious OpenAPI documents can cause arbitrary code generation, executed when anyone imports the generated client

ContainerizationOCI accepts unvalidated OCI descriptor digests, enabling path traversal in the local content store

Token scope bypass on GET /api/v1/orgs: the read:organization check ran after the handler that answered the request

Gitea Actions: fork pull request approval bypass via pull_request_review_comment (missing WithPullRequest)

A fork pull request author can satisfy a required Actions status check without any workflow running

Attachments created before the January 2026 cutoff skip the cross repository check, serving private attachments through any public repository's path

Verify the Fluentd server identity in the fluent-forward module

Agent HTTPS transport defaults to verification_mode none, so a default install performs no TLS certificate verification

remoted /download serves any group's merged.mg to any authenticated agent, no membership check

manager/maven-wrapper: Command injection via unescaped distributionType

manager/mix: Command injection via unescaped organization

Normalize request path in remote admin access-control check (defense-in-depth)

Guard ext4 extent-tree parsing against out-of-bounds reads on malformed images

Guard ext4 directory-entry parsing against out-of-bounds reads on malformed images

Deny inherited object members in access-control checks instead of throwing

Support hashed and encrypted OTP storage in the phone-number plugin

Enforce password validation for empty passwords in update_user

Improve login attempt limiting under concurrent requests

Normalize request path in remote admin access-control check (defense-in-depth)

Add NSE script to detect WordPress "wp2shell" pre-auth RCE

Reject unhashable keys in RESP3 map parsing