Sec-Reex

**Name of the Vulnerable Software and Affected Versions** Budibase backend-core (affected versions not specified) **Description** The software fails to include the shared address space range 100.64.0.0/10 in its default Server-Side Request Forgery (SSRF) blacklist used for REST datasource query previews. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. An authenticated user with Builder permissions can send a request to the 'POST /api/queries/preview' endpoint targeting a service within the 100.64.0.0/10 range, leading the server to forward the request and return the response. **Recommendations** Add 100.64.0.0/10 to the `DEFAULT BLACKLIST` to prevent requests to the shared address space range.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.7.2 **Description** An authenticated attacker can exploit a path traversal issue in the `/export/temp/` endpoint within the `serveExport` handler (located in `kernel/server/serve.go`). The vulnerability exists because the short-circuit branch of this handler joins the percent-decoded request path with `util.TempDir` without performing `IsSubPath` or `IsSensitivePath` security checks. By using percent-encoded traversal sequences, such as `%2e%2e` (which decodes to `..`), an attacker can bypass sensitive-file protections to read arbitrary files outside the intended directory, including system files like `/etc/passwd`, SSH keys, and workspace `.db` and `.log` files. **Recommendations** Update SiYuan to version 3.7.2 or later.

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only.

**Name of the Vulnerable Software and Affected Versions** Gitea version 1.25.4 **Description** A flaw exists where webhooks created by a collaborator with admin permissions on a private repository continue to trigger after the collaborator's access has been revoked. The `DeleteCollaboration()` function in `services/repository/collaboration.go` removes collaboration records, recalculates access, drops watches, and unassigns issues, but fails to remove or disable webhooks created by that user. Furthermore, the webhook delivery process does not re-validate if the creator still has access to the repository. This allows a former collaborator to receive full payloads of future repository events, including issue and comment bodies and commit data, at their controlled endpoint indefinitely and invisibly. **Recommendations** Update Gitea to a version where the `DeleteCollaboration()` function is updated to delete or disable webhooks created by the removed collaborator, or transfer ownership of those webhooks to the repository owner. Implement a re-validation check of the creator's current repository access before each webhook delivery. As a temporary mitigation, manually audit and remove webhooks created by users whose access has been revoked.

**Name of the Vulnerable Software and Affected Versions** Network-AI versions 5.12.2 through 5.13.3 **Description** The software fails to apply the configured authorization check `checkAuth/secret` to the ApprovalInbox GET read routes. This allows unauthenticated actors to access sensitive approval request details, including action/target shell-command strings, file paths, justifications, and risk levels. The affected API endpoints are '/approvals/?status=all', '/approvals/:id', '/approvals/stats', and '/approvals/sse'. Additionally, responses include a hardcoded Access-Control-Allow-Origin: * header, which enables cross-origin disclosure from any website visited by the operator. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.