Weekly briefing

SecurityFallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

SecurityGoobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

SecurityGoobi viewer: OpenID JWT audience not enforced by the verifier

SecurityGoobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

SecurityGoobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

SecurityGoobi viewer: Solr injection via unvalidated region parameter in spatial search

SecurityGoobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters

SecurityGoobi viewer: WebSocket endpoints lack server-side authentication and origin validation

SecurityGoobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

SecurityHID: steam: Clean up locking

SecurityHID: steam: Rearrange teardown sequence

SecurityHID: steam: Refactor registration

SecurityHP One Agent Software – Security Update

SecurityHTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions

SecurityHappy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

SecurityHeimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode

SecurityHeimdall: IP Spoofing via Unvalidated Forwarding Headers

SecurityHmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity

SecurityHugging Face Datasets 5.1.0 Pickle Deserialization RCE via Pandas Builder

SecurityIf an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the clu…

SecurityImproper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.

SecurityImproper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-def…

SecurityImproper Neutralization of Special

SecurityImproper sanitization in the registration module allows reflected Cross-Site Scripting.