v vanemmerik.ai / SUPPLY-CHAIN
vanemmerik.ai / supply-chain / 2026-06-12
Supply Chain · Watch Friday · 12 June 2026 End-of-day synthesis 4 watches · 58 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — Four hundred-plus Arch AUR packages are poisoned with an infostealer and eBPF rootkit on the same day Budibase, TYPO3 and File Browser ship coordinated emergency mass-patches.

The day's center of gravity is the Arch User Repository: more than 400 AUR packages were hijacked to ship an infostealer paired with an eBPF rootkit that hides the payload at the kernel level. The AUR builds from source on your own host with no review gate between a maintainer account and your `makepkg` — so this is the npm/PyPI poisoning pattern transplanted into a distro a lot of engineers trust by habit.

Underneath that, today was a coordinated-disclosure firehose. Budibase cut a single 3.39.0 release closing seven advisories, topped by a workspace-scoped builder escalating to global admin (CVE-2026-48150, CVSS 9.0); TYPO3 shipped an emergency set of roughly fifteen fixes spanning Form Framework privilege-escalation-plus-SQL-injection, insecure deserialization and a stack of broken-access-control holes; File Browser patched seven access-control and path-traversal bugs at once; and esbuild — under most of the JavaScript build world — fixed an RCE where a hijacked NPM_CONFIG_REGISTRY defeats its Deno-module integrity check. CISA added Oracle PeopleSoft's unauthenticated-takeover bug to KEV with a ransomware flag, and a decade-long China-linked backdoor in Linux login software surfaced as the patient espionage counterpoint to the noisy registry attack.

The bright spot is that the framework fires are single-bump fixes: one Budibase release, one TYPO3 point release per branch, esbuild 0.28.1. Operational priority for the night: if you build from the AUR, treat anything updated in the last 48 hours as suspect — rebuild from known-good PKGBUILDs, hunt for unexpected eBPF programs with `bpftool prog list`, and rotate any credential those build hosts could read — then bump Budibase to 3.39.0 and esbuild to 0.28.1 before morning.

21:00 ET · Last Watch
High · GHSA · File Browser github.com/filebrowser/filebrowser (go) ·added 21:00 ET

File Browser: command-execution allowlist bypass via shell metacharacter injection (CVE-2026-54090)

File Browser's command-runner allowlist can be bypassed with shell metacharacters, turning the command feature into arbitrary execution on the host (CVE-2026-54090) — the highest-impact bug in the same seven-CVE coordinated release whose access-control lead landed earlier today. On an internet-exposed instance with the command runner enabled this is RCE, not just scope escape. Upgrade to the latest File Browser release (past 2.63.13) and disable the command runner if you don't use it.

High · GHSA · File Browser github.com/filebrowser/filebrowser (go) ·added 21:00 ET

File Browser: unauthenticated DoS via public login API (CVE-2026-54092)

An unauthenticated call to File Browser's public login API can exhaust resources and knock the instance over (CVE-2026-54092, CVSS 6.5) — the public-login DoS already enumerated in today's seven-CVE File Browser release. It's pre-auth and internet-reachable, so it's a cheap take-down for anything exposed. Patch to the current release.

High · GHSA · File Browser github.com/filebrowser/filebrowser (go) ·added 21:00 ET

File Browser: improper access control via pre-created public share for a non-existent path (CVE-2026-54096)

A public share created against a path that doesn't yet exist later resolves to whatever gets written there, handing out unintended public access (CVE-2026-54096) — same access-control family as the seven-CVE lead. Audit any pre-created public shares pointing at not-yet-existing paths and upgrade past 2.63.13.

18:00 ET · First Watch
Critical · BleepingComputer + The Hacker News · 2026-06-12 ·added 18:00 ET

Over 400 Arch Linux AUR packages hijacked to ship an infostealer paired with an eBPF rootkit

Attackers compromised more than 400 packages in the Arch User Repository, planting an infostealer alongside an eBPF-based rootkit that hides the payload at the kernel level — an active, at-scale poisoning of a user-curated registry that builds from source on the target host. The AUR has no review gate between a maintainer account and your `makepkg`, so this is the npm/PyPI campaign shape transplanted to a distro many engineers trust by habit. If you install from the AUR, treat anything updated in the last 48 hours as suspect: rebuild from known-good PKGBUILDs, hunt for unexpected eBPF programs (`bpftool prog list`), and rotate any credential the affected build hosts could read.

Critical · CISA KEV · Oracle PeopleSoft · added 2026-06-12 ·added 18:00 ET

CISA adds Oracle PeopleSoft PeopleTools missing-authentication-for-critical-function bug to KEV — full takeover, ransomware-linked (CVE-2026-35273)

CISA catalogued CVE-2026-35273 today: an unauthenticated attacker can reach a critical PeopleTools function with no auth and take over the PeopleSoft instance (CWE-306), and CISA flags it as already used in ransomware. Federal due date is 2026-06-15, which is the urgency signal for everyone else too. Apply Oracle's alert-CVE-2026-35273 fix now and get PeopleSoft admin interfaces off the public internet.

Critical · GHSA · Budibase @budibase/server (npm) ·added 18:00 ET

Budibase workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign (CVE-2026-48150, CVSS 9.0)

A builder confined to a single Budibase workspace can call `/api/public/v1/roles/assign` to grant themselves global admin across the whole instance — full vertical privilege escalation from the lowest builder tier (CVSS 9.0). This is the headline of a seven-advisory Budibase day and the reason the whole 3.39.0 release is non-optional. Upgrade `@budibase/server` to 3.39.0 immediately and audit role assignments for any escalation that already happened.

High · GHSA · esbuild (npm) ·added 18:00 ET

esbuild: Deno module skips binary integrity verification, so a hijacked NPM_CONFIG_REGISTRY delivers RCE (CVE pending, CVSS 8.1)

esbuild's Deno integration downloads its platform binary without verifying integrity, so anyone who can set `NPM_CONFIG_REGISTRY` (a poisoned env, a malicious registry mirror, a compromised CI variable) gets esbuild to fetch and execute an attacker-supplied binary — registry-redirection straight to RCE in a tool sitting under most of the JavaScript build world. This is the install-time-trust failure that keeps recurring: the fetch is authenticated by nothing. Upgrade esbuild to 0.28.1 and pin/scrub `NPM_CONFIG_REGISTRY` in CI.

High · GHSA · Budibase @budibase/server (npm) ·added 18:00 ET

Budibase: basic app users exfiltrate stored REST datasource auth by rewriting the datasource base URL (CVE-2026-48152, CVSS 8.1)

A plain app user — not a builder — can rewrite a REST datasource's base URL so Budibase replays the datasource's stored credentials to an attacker-controlled host, exfiltrating the saved auth. One of seven advisories in the 3.39.0 roll-up, and the same outbound-request-primitive shape as the OAuth2 and executeQuery SSRFs flagged earlier today. Patch to 3.39.0 and rotate any secrets held in REST datasources.

High · GHSA · Budibase @budibase/server (npm) ·added 18:00 ET

Budibase: webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook/automation schema (CVE-2026-48151, CVSS 7.5)

Budibase's webhook schema endpoint skips authorization, letting an unauthenticated caller mutate webhook and automation schemas — a foothold to rewire automations on an instance you don't have an account on. Third high in the Budibase 3.39.0 set, alongside two more mediums (VectorDB SSRF, worker CSRF bypass). Upgrade once; it clears the whole cluster.

High · GHSA · TYPO3 typo3/cms-form (composer) ·added 18:00 ET

TYPO3 emergency release: privilege escalation + SQL injection in the Form Framework (CVE-2026-49741), leading a ~15-advisory coordinated set

TYPO3 shipped a coordinated security release of roughly fifteen advisories spanning every supported branch (10.4–14.3); the sharpest is privilege escalation chained with SQL injection in the Form Framework (CVE-2026-49741), with insecure deserialization via the Core API (CVE-2026-49740), destructive file-mount actions, and a stack of broken-access-control and XSS fixes filling out the set. For anyone running TYPO3 this is a single mandatory bump to 10.4.57 / 11.5.51 / 12.4.46 / 13.4.31 / 14.3.3 — the breadth, not any one CVE, is the story. Update to your branch's fixed point release tonight and re-run the html-sanitizer (2.3.2) bump with it.

High · GHSA · File Browser github.com/filebrowser/filebrowser (go) ·added 18:00 ET

File Browser: incorrect access control on public directory shares via rule path rebasing (CVE-2026-54091), lead of a seven-advisory release

File Browser's public directory shares can be rebased past their intended rule path, exposing files the share was never meant to reach (CVE-2026-54091) — the lead of a seven-CVE coordinated release that also closes symlink-following scope escape, backslash path traversal in zip/tar download, cross-user share-link deletion, and a public-login DoS. It's a self-hosted file UI people deliberately expose, so the access-control bugs are directly internet-reachable. Upgrade past 2.63.13 and audit existing public shares for paths outside their intended root.

High · GHSA · GeoServer gs-web-app (maven) ·added 18:00 ET

GeoServer: arbitrary file write via the Master Password Dump page (CVE-2025-52465, CVSS 7.2), plus an XML-entity SSRF (CVE-2025-58175)

GeoServer's master-password dump page allows an arbitrary file write (CVE-2025-52465) and a companion advisory adds an XML-entity-resolution SSRF (CVE-2025-58175) — the second GeoServer cluster this week after this morning's DB2-JNDI RCE. File write on an admin-reachable, frequently-internet-exposed map server is a clean path to webshell. Upgrade to 2.26.4 / 2.27.3 and get the GeoServer admin UI off public networks.

High · GHSA · Radius github.com/radius-project/radius (go) ·added 18:00 ET

Radius: an injected deployment annotation makes the controller delete a container resource on multi-tenant installs (CVE-2026-53999, CVSS 7.7)

On multi-tenant Radius installs, an attacker who can set a deployment annotation can steer the Radius controller into deleting another tenant's container resource — cross-tenant destructive action driven through a trusted reconcile loop. Anyone running Radius as shared application-platform control plane should treat tenant isolation as currently broken. Upgrade to 0.58.0.

High · GHSA · Appsmith com.appsmith:server (maven) ·added 18:00 ET

Appsmith: config-dependent origin-validation bypass in password-reset / email-verification links (CVSS 8.1), plus a super-user creation race (GHSA-9wcp, 8.1)

Appsmith's password-reset and email-verification links can be generated against an attacker-influenced origin under common configurations, handing the reset/verification flow to the attacker; a paired advisory (GHSA-9wcp-79g5-5c3c) lets a creation race produce multiple instance administrators. Two account-takeover-grade bugs in a widely self-hosted internal-tools platform. Upgrade Appsmith server past 2.0 / 1.99.0 and review admin accounts for unexpected entries.

High · GHSA · PyO3 (crates.io) ·added 18:00 ET

PyO3: out-of-bounds read in nth / nth_back for PyList and PyTuple iterators (plus a missing Sync bound on new_closure)

PyO3's `nth`/`nth_back` iterator methods on `PyList` and `PyTuple` read out of bounds, and a companion advisory drops a missing `Sync` bound on `PyCFunction::new_closure` closures — memory-safety and soundness holes in the layer binding Rust to CPython that underpins a large slice of the modern Python-extension ecosystem (pydantic-core, cryptography backends, ML wheels). Bump PyO3 to 0.29.0; it's a transitive dependency you may be carrying without naming it.

Medium · GHSA · Fleet github.com/fleetdm/fleet (go) ·added 18:00 ET

Fleet: observer-role enrollment-secret extraction via an ORDER BY oracle (CVE-2026-46371, plus CVE-2026-46370 on the labels endpoint)

A read-only Observer in Fleet can extract enrollment secrets by abusing an ORDER BY oracle on the Apple MDM commands endpoint, with a twin advisory exploiting the same oracle on the labels host-listing endpoint. Enrollment secrets are what new hosts use to join the fleet, so leaking them to a low-privilege role undermines device-enrollment trust. Upgrade past 4.84.1.

Medium · GHSA · ConnectBot sshlib (maven) ·added 18:00 ET

ConnectBot sshlib: integer overflow / excessive allocation in DER private-key parsing and unbounded SSH field lengths

ConnectBot's SSH client library over-allocates on an integer overflow while parsing DER private keys and accepts unbounded SSH field lengths — the same allocation-before-validation shape as this week's russh advisories, now in the Java/Android SSH stack. Update sshlib past 0.3.0 anywhere you embed it for SSH client work.

Context · The Hacker News · 2026-06-12 ·added 18:00 ET

China-linked actor backdoored Linux login software and stayed hidden for nearly a decade

Researchers detailed a China-linked operation that trojanized Linux login software (PAM/authentication components) to harvest credentials and persist undetected for close to ten years. It's espionage tradecraft rather than a registry attack, but it rhymes with today's AUR campaign: both subvert the trusted software a host runs at its most privileged moment. Worth reading as the patient, targeted counterpoint to the noisy, opportunistic mass-poisoning — and a prompt to checksum your auth stack against distro packages.

12:00 ET · Forenoon Watch
Critical · GHSA · CodeIgniter4 codeigniter4/framework (composer) ·added 12:00 ET

CodeIgniter4 file-upload validation bypass: ext_in checks the MIME-guessed extension, not the filename — shell.php with GIF bytes passes (CVE-2026-48062)

CodeIgniter4's `ext_in` upload rule validated the MIME-guessed extension instead of the client-supplied filename, so a file named `shell.php` carrying GIF-like bytes sails through `is_image|mime_in[image/gif]|ext_in[gif]` and lands on disk as executable PHP. This is the classic polyglot-upload-to-RCE shape, made worse because the bypass lives in the framework's own validation primitive everyone trusts. Upgrade to 4.7.2; until then stop trusting `ext_in` alone — pin allowed extensions off the real filename and serve uploads from a non-executable path.

High · GHSA · Budibase @budibase/server (npm) ·added 12:00 ET

Budibase OAuth2 token fetch skips the SSRF blacklist used everywhere else — BUILDER role reaches cloud metadata / internal CouchDB (CVE-2026-48146)

Budibase's OAuth2 token fetch calls raw `fetch(config.url)` with none of the `fetchWithBlacklist()` SSRF guarding that wraps every other outbound call in the codebase, so a BUILDER-role user can aim the token URL at cloud metadata or internal CouchDB and exfiltrate secrets. Textbook consistency-gap bug: the safe wrapper exists, it just wasn't wired into this path. Upgrade `@budibase/server` to 3.39.0; if you self-host with low-trust builders, treat the metadata endpoint as already reachable and rotate anything it could have exposed.

High · GHSA · SwiftNIO github.com/apple/swift-nio (swift) ·added 12:00 ET

SwiftNIO HTTPDecoder enforces no limit on HTTP/1 header-block size or count — unbounded small headers exhaust memory pre-application (CVE-2026-28980)

SwiftNIO's `HTTPDecoder` caps neither the total HTTP/1 header-block size nor the header count, so a remote peer can stuff one request with unlimited small valid headers and exhaust server memory before any application code runs. Everything built on swift-nio (Vapor, gRPC-swift, server-side Swift fleets) inherits this. Upgrade to 2.100.0.

High · GHSA · SwiftNIO github.com/apple/swift-nio (swift) ·added 12:00 ET

SwiftNIO ByteBuffer out-of-bounds write via UInt32 index/length overflow — affects all releases 1.0.0–2.99.0 (CVE-2026-43671)

swift-nio's `ByteBuffer` stores indices and capacities as `UInt32`; attacker-controlled index/length values above `UInt32.max` overflow internal helpers into a potential out-of-bounds write, affecting every release from 1.0.0 to 2.99.0. A memory-safety bug in the buffer primitive sitting underneath the entire server-side Swift ecosystem. Fixed in 2.100.0 — prioritise this one across the SwiftNIO cluster landing today.

High · GHSA · Chisel github.com/jpillora/chisel (go) ·added 12:00 ET

Chisel enforces its authfile ACL only at handshake, never on traffic-bearing SSH channels — authenticated client tunnels anywhere the server can reach (CVE-2026-48113)

Chisel checks its `--authfile` remote ACL only during the SSH handshake against declared remotes, never on the channels that carry actual traffic, so an authenticated client can declare a permitted remote and then open channels to any `host:port` the server can reach. If you run chisel as a constrained tunnel relay, the constraint is illusory — treat any authenticated client as able to pivot anywhere on the server's network. Upgrade, and don't lean on authfile for segmentation.

High · GHSA · russh crates.io/russh (rust) ·added 12:00 ET

russh decodes SSH strings/name-lists/byte fields into allocations before field-specific bounds — remote peer drives memory pressure and panics pre-auth (CVE-2026-48110)

russh decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds, so a remote peer can send oversized or high-fanout length-prefixed fields and drive memory pressure or panics before authentication. Same allocation-before-validation shape as the other russh advisories earlier this week. Upgrade russh — it's the SSH library a growing number of Rust tools embed.

High · GHSA · AWS Advanced Go Wrapper github.com/aws/aws-advanced-go-wrapper (go) ·added 12:00 ET

AWS Advanced Go Wrapper privilege escalation to rds_superuser on Aurora PostgreSQL — spans the whole module family (CVE-2026-11401)

The AWS Advanced Go Wrapper for Aurora PostgreSQL lets a low-privilege authenticated DB user craft a function that runs with elevated permissions and escalate to the `rds_superuser` role (CVE-2026-11401). It spans the whole module family — awssql, pgx-driver, iam, okta, secrets-manager, federated-auth and friends — so the fix is a coordinated bump across every `aws-advanced-go-wrapper/*` you import. Grep go.mod for these modules and upgrade all of them together.

High · GHSA · DevGuard github.com/l3montree-dev/devguard (go) ·added 12:00 ET

DevGuard public assets: any authenticated user from any org can create/update/delete VEX rules and vuln-triage records (CVE-2026-48089)

On DevGuard instances with public assets, any authenticated user — including someone from a different org with no membership — can create, update, reapply and delete VEX rules and other vuln-triage records on those assets. For a tool whose job is tracking which CVEs matter, letting outsiders rewrite your VEX suppressions is a data-integrity problem that quietly hides real findings. Upgrade and audit VEX-rule history on any public asset.

High · GHSA · Netty io.netty:netty-codec-haproxy (maven) ·added 12:00 ET

Netty HAProxy PROXY-v2 codec leaks memory on every connection carrying nested PP2_TYPE_SSL TLVs — slow exhaustion on the success path (CVE-2026-48059)

Netty's HAProxy PROXY-protocol-v2 codec leaks native or heap memory on every connection carrying nested `PP2_TYPE_SSL` TLVs at depth two or greater — and it leaks on the successful parse path, no exception thrown, so it's a slow bleed under normal-looking traffic. Anything fronting Netty with PROXY protocol enabled (LB-terminated TLS passthrough) is exposed to gradual exhaustion. Upgrade netty-codec-haproxy.

Medium · GHSA · Budibase @budibase/server (npm) ·added 12:00 ET

Budibase second SSRF: user-controlled queryId in the executeQuery automation step turns an internal-facing REST datasource into an outbound-request primitive (CVE-2026-48128)

A second Budibase SSRF: the executeQuery automation step takes a user-controlled `queryId` and runs it without validation, so a REST datasource pointed at internal infrastructure becomes an outbound-request primitive. Same blast radius as the OAuth2 hole above, and it ships in the same 3.39.0 fix. Patch both together.

Medium · GHSA · LangGraph langgraph-checkpoint-mongodb (npm) ·added 12:00 ET

LangGraph MongoDBSaver NoSQL injection: $gt/$ne operators in checkpoint IDs bypass thread scoping and read other tenants' agent state (CVE-2026-48121)

LangGraph's `MongoDBSaver` interpolated checkpoint identifiers from `config.configurable` into Mongo queries without type enforcement, so an attacker passing `$gt`/`$ne` objects gets operator injection and can bypass thread scoping to read other tenants' agent state. As LangGraph checkpointers increasingly hold conversation and tool memory, cross-tenant state access is a real confidentiality leak in agentic stacks. Upgrade and enforce string types on checkpoint IDs.

Medium · GHSA · Kolibri learningequality/kolibri (pip) ·added 12:00 ET

Kolibri unauthenticated SSRF: RemoteFacilityUser viewsets fetch and reflect an attacker-controlled baseurl, GET endpoint needs no auth (CVE-2026-48053)

Kolibri's `RemoteFacilityUser` viewsets accept an unvalidated `baseurl` and fetch then reflect attacker-controlled URLs — four reflection points on the same pattern, and the GET endpoint is unauthenticated. Unauthenticated reflected SSRF is a clean internal-network scanner against any exposed Kolibri. Upgrade.

Medium · GHSA · SwiftNIO HTTP/2 github.com/apple/swift-nio-http2 (swift) ·added 12:00 ET

swift-nio-http2 downgrade codec doesn't strip CR/LF/NUL from pseudo-headers — HTTP/2-to-HTTP/1 request smuggling via :path (CVE-2026-28898, GHSA-rated low)

swift-nio-http2's HTTP/2-to-HTTP/1.1 server codec didn't validate pseudo-header values such as `:path` for control characters before placing them in the translated HTTP/1.1 message, so a crafted HTTP/2 request smuggles CR/LF/NUL into the downgraded request. GHSA rates it low, but smuggling past a front-end is the kind of low that bites in layered HTTP/2-terminating deployments. Upgrade swift-nio-http2 to the patched release alongside the rest of today's SwiftNIO set.

Medium · GHSA · SwiftNIO Extras github.com/apple/swift-nio-extras (swift) ·added 12:00 ET

NIOExtras decompression ratio limit is measured against the attacker-supplied Content-Length, so a lied header disables the zip-bomb guard (CVE-2026-28975)

`NIOHTTPRequestDecompressor` configured with `.ratio(N)` enforces the limit using the request's `Content-Length` header rather than the actual compressed bytes received, so a client supplying an inflated value makes the ratio check always pass — the decompression-bomb guard becomes a no-op. If you added ratio limiting specifically to defend against compressed-body bombs, it currently isn't defending anything. Upgrade swift-nio-extras.

Medium · GHSA · Firefly III firefly-iii/firefly-iii (composer) ·added 12:00 ET

Firefly II stored XSS: piggy-bank name rendered through Twig |raw in the audit-log view fires JS at anyone reviewing that transaction

Firefly II renders a piggy-bank name through Twig's `|raw` filter in the audit-log entry view (`ale.twig`), so a piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log. Self-hosted personal-finance app, but the audit log is exactly where an admin looks when something seems off. Upgrade.

Medium · GHSA · go-attestation github.com/google/go-attestation (go) ·added 12:00 ET

go-attestation parseEfiSignatureList() skips no SignatureHeaderSize vendor bytes — crafted TPM event log injects arbitrary SHA256 hashes into the trusted measurement list

`parseEfiSignatureList()` in go-attestation does not skip `SignatureHeaderSize` vendor bytes before reading `EFI_SIGNATURE_LIST` entries, so for SHA256 lists a crafted TPM event log can inject arbitrary hashes into the trusted measurement list. Anyone using go-attestation to make trust decisions from TPM logs is making them off poisonable data, which undermines the whole attestation. Upgrade.

Medium · GHSA · Filament filament/filament (composer) ·added 12:00 ET

Filament AttachAction/AssociateAction scope the Select options but not the validation rule — Livewire state tampering submits an out-of-scope record (CVE-2026-48067)

Filament's `AttachAction` and `AssociateAction` apply `recordSelectOptionsQuery()` scoping to the Select field's options but not to the built-in validation rule, so a user who can trigger these actions can tamper with the Livewire component state and submit an out-of-scope record ID. Classic UI-scopes-but-server-doesn't authorization gap in a very widely deployed Laravel admin panel. Upgrade Filament.

Context · BleepingComputer / Flare · 2026-06-12 ·added 12:00 ET

Flare: dark-web chatter — GitHub access sales, leaked repos, stolen API keys — as the early-warning layer for supply-chain attacks

BleepingComputer, via Flare, walks through how underground forums surface the precursors to supply-chain compromise — GitHub access for sale, leaked private repositories, stolen API keys — before the malicious package ever ships. Context rather than an incident: a reminder that the credential-theft campaigns behind this week's KEV adds begin as commodities on forums you can actually monitor. Useful framing if you're standing up a supply-chain threat-intel function.

06:00 ET · Morning Watch
High · GHSA · GeoServer gs-db2 (maven) ·added 06:00 ET

GeoServer DB2 extension JNDI → RCE: admin-supplied DB2 JDBC URL triggers JNDI lookup and untrusted deserialization (CVE-2025-27511, CVSS 7.2)

An authenticated user with access to GeoServer's Vector Data Sources page can point a new DB2 data store at an attacker-controlled JDBC URL; unrestricted connection params drive a JNDI lookup that deserializes untrusted data and lands RCE (CWE-74/CWE-502). It's a high-privilege bug (PR:H), but GeoServer instances are routinely exposed and over-permissioned, and JDBC-JNDI is the same log4shell-shaped primitive that keeps paying off. Upgrade to GeoServer 2.27.0; if the DB2 extension isn't in use, remove gs-db2 rather than leaving the data-store path reachable.

High · GHSA · @grpc/grpc-js (npm) ·added 06:00 ET

@grpc/grpc-js: malformed compressed message crashes client or server (CVE-2026-48069)

A malformed incoming compressed message can crash either side of a @grpc/grpc-js connection — an unauthenticated remote DoS against any Node service speaking gRPC. This is the second grpc-js crash bug in two days (yesterday's GHSA-5375 was a malformed-request server crash); together they say: a single bad frame takes the process down. Bump @grpc/grpc-js to the patched release and confirm transitive pins via grpc-js-bundled tooling (proto-loader, service meshes' sidecars).

High · GHSA · WsgiDAV (PyPI) ·added 06:00 ET

WsgiDAV: encoded dot-segments escape filesystem share roots (CVE-2026-48099)

WsgiDAV failed to normalize percent-encoded `..` segments, letting a crafted WebDAV path traverse outside the configured share root and read files elsewhere on the host. Anywhere WsgiDAV fronts a directory you assumed was sandboxed (CI artifact stores, internal file shares), this is arbitrary file read. Patch to the fixed version and grep access logs for `%2e%2e` / `..%2f` against your DAV endpoints.

High · GHSA · Arc (Go) ·added 06:00 ET

Arc: unauthenticated Go net/http/pprof endpoints leak runtime state and enable CPU-exhaustion DoS (CVE-2026-48050)

Arc mounted Go's debug `/debug/pprof` handlers without auth, exposing heap/goroutine dumps (which leak in-memory secrets and internal structure) and a profiling endpoint an attacker can hit to pin CPU. This is the canonical Go footgun — `import _ "net/http/pprof"` silently registering on the default mux. Patch Arc, and audit your own services for pprof bound to a public listener; it should only ever be on a localhost/admin port.

High · GHSA · MessagePack for C# (NuGet) ·added 06:00 ET

MessagePack (.NET): LZ4 decompression dereferences before bounds check, AccessViolationException on crafted payload (CVE-2026-48109)

MessagePack-CSharp's LZ4 path dereferences a pointer before validating length, so a malformed compressed blob faults the process with an AccessViolationException — an unauthenticated remote DoS for any .NET service deserializing untrusted MessagePack. Widely embedded in game servers and RPC layers where the wire format is attacker-reachable. Update the NuGet package; if you can't, disable LZ4 compression on untrusted inputs.

High · GHSA · Element Call (npm) ·added 06:00 ET

Element Call leaks full URLs of visited pages to its analytics server (CVE-2026-48007)

Element Call sent complete page URLs — which can carry call identifiers and tokens in the path/query — to its analytics backend, a privacy and potential session-leak issue for a tool deployed precisely because it's supposed to be private. Update to the patched build and, if you self-host, confirm analytics is disabled or pointed only at infrastructure you control.

Medium · GHSA · @hapi/wreck (npm) ·added 06:00 ET

@hapi/wreck leaks Authorization/cookie headers across cross-port and cross-scheme redirects (CVE-2026-48022)

@hapi/wreck replayed sensitive headers (Authorization, Cookie) when following a redirect to a different port or scheme on the same host, so an http→https or :443→:8080 hop forwards your credentials to a context that shouldn't see them. Classic redirect credential-leak shape — the fix is to strip auth headers on any origin change. Patch wreck and audit any service that follows redirects with static auth headers attached.

Medium · GHSA · joi (npm) ·added 06:00 ET

joi: uncaught RangeError on deeply nested input via recursive link() schemas (CVE-2026-48038)

A deeply nested payload validated against a recursive `link()` schema in joi blows the stack with an uncaught RangeError, crashing the handler — an unauthenticated DoS at the validation layer that's supposed to be your first line of defense. joi sits in front of countless Node APIs, so the blast radius is wide. Update joi and bound input depth/size before it reaches schema validation.

Medium · GHSA · OpenFGA (Go) ·added 06:00 ET

OpenFGA: cache-key delimiter injection poisons shared-iterator and v2 iterator authorization caches (CVE-2026-48096)

OpenFGA built cache keys by concatenating fields without escaping the delimiter, so crafted identifiers can collide keys and return another tuple's cached authorization decision — a stale/incorrect allow in the system you're using *as* your authorization source of truth. Authz-cache poisoning is a quiet, high-consequence bug class. Patch OpenFGA and, if feasible, flush the check cache after upgrade.

Medium · GHSA · guzzlehttp/psr7 (Composer) ·added 06:00 ET

guzzlehttp/psr7: Host confusion via authority reinterpretation (CVE-2026-48998)

psr7 could reinterpret a URI's authority component such that the effective Host differs from what an application parsed, opening request-routing and SSRF-filter-bypass shapes where your allowlist and the actual connection disagree. Update guzzlehttp/psr7; pairs with the CRLF advisory below.

Medium · GHSA · guzzlehttp/psr7 (Composer) ·added 06:00 ET

guzzlehttp/psr7: CRLF injection via URI host component (CVE-2026-49214)

A URI host carrying CR/LF could inject header-splitting sequences into requests built from psr7 messages — the classic path to smuggling or response splitting when the host is attacker-influenced. Patch alongside the host-confusion fix; both land in the same psr7 release.

Medium · GHSA · io.netty:netty-codec-http2 (maven) ·added 06:00 ET

netty-codec-http2: ByteBuf reference-count leak in DelegatingDecompressorFrameListener (CVE-2026-48043)

A reference-count leak in Netty's HTTP/2 decompression listener slowly exhausts pooled direct memory under crafted traffic — a gradual OOM/DoS for the JVM services (proxies, gateways, gRPC backends) that sit on Netty. Bump netty-codec-http2; one of several Netty memory-management advisories this week, so reconcile your whole netty-* version set.

Medium · GHSA · @hapi/inert (npm) ·added 06:00 ET

@hapi/inert: static-file confinement bypass via sibling-prefix path (CVE-2026-48049)

@hapi/inert's directory handler could be coaxed past its configured root using a sibling-prefix path (e.g. `/safeDIR` matching `/safe`), serving files outside the intended static directory. Patch inert and double-check that any path-prefix route guards aren't relying on the same naive prefix match.