Common Weakness Enumeration
CWE-791
AllowedIncomplete Filtering of Special Elements
Abstraction: Base · Status: Incomplete
The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.
78 vulnerabilities reference this CWE, most recent first.
GHSA-8P33-Q827-GHJ5
Vulnerability from github – Published: 2026-05-06 18:13 – Updated: 2026-06-18 22:54
VLAI
Summary
dssrf: every IPv6 category bypasses is_url_safe
Details
A vulnerability on dssrf allow, an attacker to use, one of them following ipv6
Input Category
http://[::1]/ IPv6 loopback
http://[fc00::1]/ IPv6 ULA
http://[fe80::1]/ IPv6 link-local
http://[::ffff:127.0.0.1]/ IPv4-mapped loopback
http://[::ffff:169.254.169.254]/ IPv4-mapped IMDS
http://[::ffff:100.64.0.1]/ IPv4-mapped CGNAT
http://[64:ff9b::7f00:1]/ NAT64 well-known prefix
http://[64:ff9b:1::1]/ NAT64 local-use (RFC 8215)
http://[5f00::1]/ SRv6 SID (RFC 9602)
http://[3fff::1]/ IPv6 documentation (RFC 9637)
http://[fec0::1]/ IPv6 site-local (deprecated, RFC 3879)
http://[::127.0.0.1]/ IPv4-compatible IPv6
one of those to bypass dssrf and the attacker get SSRF, we claim that ipv6 disabled entirely that is wrong on our documentation
POC
mkdir dssrf-poc && cd dssrf-poc
npm init -y >/dev/null
npm install dssrf@^1.0.2
cat > audit.js <<'EOF'
const dssrf = require('dssrf');
const cases = [
['http://[::1]/', 'IPv6 loopback'],
['http://[fc00::1]/', 'IPv6 ULA'],
['http://[fe80::1]/', 'IPv6 link-local'],
['http://[::ffff:127.0.0.1]/', 'IPv4-mapped loopback'],
['http://[::ffff:169.254.169.254]/', 'IPv4-mapped IMDS'],
['http://[64:ff9b::7f00:1]/', 'NAT64 well-known + 127.0.0.1'],
['http://[64:ff9b:1::1]/', 'NAT64 local-use (RFC 8215)'],
['http://[5f00::1]/', 'SRv6 SID (RFC 9602)'],
['http://[fec0::1]/', 'IPv6 site-local deprecated'],
['http://127.0.0.1/', 'IPv4 loopback (control)'],
['http://10.0.0.1/', 'IPv4 RFC1918 (control)'],
['http://8.8.8.8/', 'PUBLIC IPv4 (control)'],
];
(async () => {
for (const [url, label] of cases) {
const safe = await dssrf.is_url_safe(url);
console.log(`${safe ? '✓ALLOW' : '·block'} ${url.padEnd(40)} ${label}`);
}
})();
EOF
node audit.js
Credit
Million Thank's to brmenna@gmail.com for reporting that responsibly.
Update
Users need to update from now to dssrf 1.0.3
Lessons Learned
AS we see in the past and today, a lot of advisories or cves bypasses uses IPv6, and IPv6 is the weakest link to be configured correctly and rarely properly tested, Since we blocked ipv4, our ipv6 blocking logic completly broken and never works
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "dssrf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44232"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T18:13:32Z",
"nvd_published_at": "2026-05-12T21:16:16Z",
"severity": "HIGH"
},
"details": "A vulnerability on dssrf allow, an attacker to use, one of them following ipv6\n\n```rust\nInput\tCategory\nhttp://[::1]/\tIPv6 loopback\nhttp://[fc00::1]/\tIPv6 ULA\nhttp://[fe80::1]/\tIPv6 link-local\nhttp://[::ffff:127.0.0.1]/\tIPv4-mapped loopback\nhttp://[::ffff:169.254.169.254]/\tIPv4-mapped IMDS\nhttp://[::ffff:100.64.0.1]/\tIPv4-mapped CGNAT\nhttp://[64:ff9b::7f00:1]/\tNAT64 well-known prefix\nhttp://[64:ff9b:1::1]/\tNAT64 local-use (RFC 8215)\nhttp://[5f00::1]/\tSRv6 SID (RFC 9602)\nhttp://[3fff::1]/\tIPv6 documentation (RFC 9637)\nhttp://[fec0::1]/\tIPv6 site-local (deprecated, RFC 3879)\nhttp://[::127.0.0.1]/\tIPv4-compatible IPv6\n```\n\none of those to bypass dssrf and the attacker get **SSRF**, we claim that ipv6 disabled entirely that is wrong on our documentation\n\n### POC\n\n```bash\nmkdir dssrf-poc \u0026\u0026 cd dssrf-poc\nnpm init -y \u003e/dev/null\nnpm install dssrf@^1.0.2\ncat \u003e audit.js \u003c\u003c\u0027EOF\u0027\nconst dssrf = require(\u0027dssrf\u0027);\nconst cases = [\n [\u0027http://[::1]/\u0027, \u0027IPv6 loopback\u0027],\n [\u0027http://[fc00::1]/\u0027, \u0027IPv6 ULA\u0027],\n [\u0027http://[fe80::1]/\u0027, \u0027IPv6 link-local\u0027],\n [\u0027http://[::ffff:127.0.0.1]/\u0027, \u0027IPv4-mapped loopback\u0027],\n [\u0027http://[::ffff:169.254.169.254]/\u0027, \u0027IPv4-mapped IMDS\u0027],\n [\u0027http://[64:ff9b::7f00:1]/\u0027, \u0027NAT64 well-known + 127.0.0.1\u0027],\n [\u0027http://[64:ff9b:1::1]/\u0027, \u0027NAT64 local-use (RFC 8215)\u0027],\n [\u0027http://[5f00::1]/\u0027, \u0027SRv6 SID (RFC 9602)\u0027],\n [\u0027http://[fec0::1]/\u0027, \u0027IPv6 site-local deprecated\u0027],\n [\u0027http://127.0.0.1/\u0027, \u0027IPv4 loopback (control)\u0027],\n [\u0027http://10.0.0.1/\u0027, \u0027IPv4 RFC1918 (control)\u0027],\n [\u0027http://8.8.8.8/\u0027, \u0027PUBLIC IPv4 (control)\u0027],\n];\n(async () =\u003e {\n for (const [url, label] of cases) {\n const safe = await dssrf.is_url_safe(url);\n console.log(`${safe ? \u0027\u2713ALLOW\u0027 : \u0027\u00b7block\u0027} ${url.padEnd(40)} ${label}`);\n }\n})();\nEOF\nnode audit.js\n```\n\n### Credit\nMillion Thank\u0027s to \u003cbrmenna@gmail.com\u003e for reporting that responsibly.\n\n### Update\nUsers need to update from now to dssrf 1.0.3\n\n### Lessons Learned\nAS we see in the past and today, a lot of advisories or cves bypasses uses IPv6, and IPv6 is the weakest link to be configured correctly and rarely properly tested, Since we blocked ipv4, our ipv6 blocking logic completly broken and never works",
"id": "GHSA-8p33-q827-ghj5",
"modified": "2026-06-18T22:54:14Z",
"published": "2026-05-06T18:13:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-8p33-q827-ghj5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44232"
},
{
"type": "PACKAGE",
"url": "https://github.com/HackingRepo/dssrf-js"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "dssrf: every IPv6 category bypasses is_url_safe"
}
GHSA-8V6X-2R55-MMXR
Vulnerability from github – Published: 2025-06-02 09:31 – Updated: 2026-01-15 18:31
VLAI
Details
The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.
Severity
9.4 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-0324"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T08:15:20Z",
"severity": "CRITICAL"
},
"details": "The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain\u00a0administrator privileges.",
"id": "GHSA-8v6x-2r55-mmxr",
"modified": "2026-01-15T18:31:25Z",
"published": "2025-06-02T09:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0324"
},
{
"type": "WEB",
"url": "https://www.axis.com/dam/public/04/f3/1c/cve-2025-0324pdf-en-US-483807.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8WG6-4HM6-85F2
Vulnerability from github – Published: 2025-06-27 12:31 – Updated: 2025-06-27 12:31
VLAI
Details
A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function plugin.buildMobilePopHtml of the file \k3\o2o\bos\webapp\action\DynamicForm 4 Action.class of the component Freemarker Engine. The manipulation leads to improper neutralization of special elements used in a template engine. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The vendor explains, that in the fixed release "Freemarker is set to 'ALLOWS_NOTHING_RESOLVER' to not parse any classes."
Severity
{
"affected": [],
"aliases": [
"CVE-2025-6761"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-27T11:15:25Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function plugin.buildMobilePopHtml of the file \\k3\\o2o\\bos\\webapp\\action\\DynamicForm 4 Action.class of the component Freemarker Engine. The manipulation leads to improper neutralization of special elements used in a template engine. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The vendor explains, that in the fixed release \"Freemarker is set to \u0027ALLOWS_NOTHING_RESOLVER\u0027 to not parse any classes.\"",
"id": "GHSA-8wg6-4hm6-85f2",
"modified": "2025-06-27T12:31:14Z",
"published": "2025-06-27T12:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6761"
},
{
"type": "WEB",
"url": "https://vip.kingdee.com/link/s/ZlWX7"
},
{
"type": "WEB",
"url": "https://vip.kingdee.com/school/detail/713028702245944320"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.314072"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.314072"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.601207"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9QV6-Q72P-WGW8
Vulnerability from github – Published: 2026-08-03 21:31 – Updated: 2026-08-03 21:31
VLAI
Details
A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code_executor/jinja2/jinja2_transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used in a template engine. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-18632"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-03T20:17:16Z",
"severity": "LOW"
},
"details": "A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code_executor/jinja2/jinja2_transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used in a template engine. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-9qv6-q72p-wgw8",
"modified": "2026-08-03T21:31:36Z",
"published": "2026-08-03T21:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18632"
},
{
"type": "WEB",
"url": "https://github.com/CVE-Hunter-Leo/CVE/issues/14"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-18632"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/853188"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/385555"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/385555/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9X6X-W4XQ-RW3G
Vulnerability from github – Published: 2026-09-05 21:31 – Updated: 2026-09-05 21:31
VLAI
Details
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
Severity
{
"affected": [],
"aliases": [
"CVE-2026-86206"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-05T20:17:18Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4",
"id": "GHSA-9x6x-w4xq-rw3g",
"modified": "2026-09-05T21:31:20Z",
"published": "2026-09-05T21:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86206"
},
{
"type": "WEB",
"url": "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release_Notes.htm"
},
{
"type": "WEB",
"url": "https://me.n-able.com/s/security-advisory/aArVy0000002LTNKA2/cve202686206-access-control-filter-bypass-allows-unauthorised-access-to-apis"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-C7W5-449G-58MM
Vulnerability from github – Published: 2026-08-16 03:31 – Updated: 2026-08-16 03:31
VLAI
Details
A vulnerability was identified in OpenBoxes up to 0.9.6. This impacts the function buildZebraTemplate of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Template Processing. The manipulation leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 will fix this issue. The identifier of the patch is deeac6a4a7aba86ce99c4bda37142e41d209293e. It is recommended to upgrade the affected component.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-19929"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-16T03:16:50Z",
"severity": "LOW"
},
"details": "A vulnerability was identified in OpenBoxes up to 0.9.6. This impacts the function buildZebraTemplate of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Template Processing. The manipulation leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 will fix this issue. The identifier of the patch is deeac6a4a7aba86ce99c4bda37142e41d209293e. It is recommended to upgrade the affected component.",
"id": "GHSA-c7w5-449g-58mm",
"modified": "2026-08-16T03:31:06Z",
"published": "2026-08-16T03:31:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OpenBoxes/OpenBoxes/security/advisories/GHSA-8wxj-vghp-jpcq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19929"
},
{
"type": "WEB",
"url": "https://github.com/OpenBoxes/OpenBoxes/pull/5943"
},
{
"type": "WEB",
"url": "https://github.com/openboxes/openboxes/commit/deeac6a4a7aba86ce99c4bda37142e41d209293e"
},
{
"type": "WEB",
"url": "https://gist.github.com/nedlir/220a30213b5a5c6bc26d1000012c6a4d"
},
{
"type": "WEB",
"url": "https://github.com/OpenBoxes/OpenBoxes"
},
{
"type": "WEB",
"url": "https://github.com/openboxes/openboxes/releases/tag/v0.9.8"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-19929"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/872054"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/390180"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/390180/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F339-R2MR-9CR3
Vulnerability from github – Published: 2025-08-18 00:30 – Updated: 2025-08-18 00:30
VLAI
Details
A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor replies, that "[t]he fix will come within upcoming release (v4.2) and will be inherited by maintenance releases of LTS versions (starting 4.0)."
Severity
{
"affected": [],
"aliases": [
"CVE-2025-9094"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-17T23:15:27Z",
"severity": "MODERATE"
},
"details": "A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor replies, that \"[t]he fix will come within upcoming release (v4.2) and will be inherited by maintenance releases of LTS versions (starting 4.0).\"",
"id": "GHSA-f339-r2mr-9cr3",
"modified": "2025-08-18T00:30:30Z",
"published": "2025-08-18T00:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9094"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1cZy-rfQXsF58kJIVs4UXj7usXJuhjZjA/view"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.320416"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.320416"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.626292"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F7QV-V8H9-5244
Vulnerability from github – Published: 2023-03-27 21:30 – Updated: 2023-04-05 15:30
VLAI
Details
A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-1076"
],
"database_specific": {
"cwe_ids": [
"CWE-791",
"CWE-843"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-27T21:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters.",
"id": "GHSA-f7qv-v8h9-5244",
"modified": "2023-04-05T15:30:24Z",
"published": "2023-03-27T21:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1076"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=66b2c338adce580dfce2199591e65e2bab889cff"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=a096ccca6e503a5c575717ff8a36ace27510ab0a"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GWJC-MXGH-5H28
Vulnerability from github – Published: 2026-08-19 03:31 – Updated: 2026-08-19 03:31
VLAI
Details
A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-75979"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T01:16:57Z",
"severity": "LOW"
},
"details": "A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-gwjc-mxgh-5h28",
"modified": "2026-08-19T03:31:20Z",
"published": "2026-08-19T03:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75979"
},
{
"type": "WEB",
"url": "https://github.com/xianrendzw/EasyReport/issues/82"
},
{
"type": "WEB",
"url": "https://github.com/xianrendzw/EasyReport"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-75979"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/877844"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/391897"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/391897/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-H3RR-9WQJ-V3C6
Vulnerability from github – Published: 2026-04-25 18:32 – Updated: 2026-05-05 20:22
VLAI
Summary
AstrBot has Incomplete Filtering of Special Elements
Details
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function create_template of the file astrbot/dashboard/routes/t2i.py of the component Dashboard API. The manipulation results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "AstrBot"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.22.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-6984"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-05T20:22:14Z",
"nvd_published_at": "2026-04-25T16:16:17Z",
"severity": "LOW"
},
"details": "A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function create_template of the file astrbot/dashboard/routes/t2i.py of the component Dashboard API. The manipulation results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-h3rr-9wqj-v3c6",
"modified": "2026-05-05T20:22:14Z",
"published": "2026-04-25T18:32:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6984"
},
{
"type": "WEB",
"url": "https://github.com/AstrBotDevs/AstrBot/issues/7330"
},
{
"type": "PACKAGE",
"url": "https://github.com/AstrBotDevs/AstrBot"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/796164"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359527"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359527/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "AstrBot has Incomplete Filtering of Special Elements"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.