Weekly briefing

SecurityStarman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers

SecurityStarman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

SecurityStarman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections

SecurityThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority.3 source records

Source marks advisory rejected · 3 entries

• This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Source marks advisory rejected

  CVE-2026-109111

  Assessment context

  Source marks advisory rejected; observed by ChangeIntel, not the original publication date.

• This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Source marks advisory rejected

  CVE-2026-111326

  Assessment context

  Source marks advisory rejected; observed by ChangeIntel, not the original publication date.

• This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Source marks advisory rejected

  CVE-2026-89284

  Assessment context

  Source marks advisory rejected; observed by ChangeIntel, not the original publication date.

SecurityUnitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection

SecurityUnitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation

SecurityWP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret

SecurityWP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR

SecurityWP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard

SecurityWP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR

SecurityWWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering

SecurityYesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax

SecurityYesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create

SecurityYesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API

SecurityYesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts

SecurityYesWiki before 4.7.0 CSRF via despam Admin Action

SecurityYesWiki before 4.7.0 Stored XSS via ImageField SVG Upload

SecurityYesWiki before 4.7.0 Stored XSS via filtertags Action Parameters

SecurityYesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax

SecurityYunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication

SecurityYunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication

SecurityZylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery

Securityadm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

Securitydbcli mycli Whitelist source.py source_special_command_is_safe os command injection