When an upstream commit fixes a CVE in one handler, vciy inspects the rest of the file and module for the same weakness class. When a fix is incomplete or a sibling endpoint carries the same defect on the default branch, we verify the code path against upstream HEAD and report the finding with a defensive remediation diff.
Running affected software? Record a mitigation decision on CVE-2026-69115, or check your software across the corpus.
Security patches frequently land under time pressure and guard only the exact route named in the initial report. Before you close a ticket as patched or record an exception, check whether the upstream fix covered sibling handlers in the same controller or viewset.
Each advisory below was identified by verifying an upstream CVE fix commit against the project's current default branch. Where coordinated disclosure via GitHub Private Vulnerability Reporting or project security mail is in progress, unpatched endpoint specifics are withheld until an upstream release is available.
Verification of the upstream fix commit for CVE-2026-90774 identified an incomplete path sanitization check and a sibling handler path that joins user-influenced path segments onto the server upload directory without canonical path containment.
Affected: rustypaste <= 0.16.1 · Status: Coordinated disclosure in progress
Commit 556cd31d8734d7c46eb12553775be40eb6cd16de fixed CVE-2026-91107 in modules/users/Staff.php by restricting $_REQUEST['staff_id'] overrides to administrators (User('PROFILE') == 'admin'). Verification of the fix commit and its sibling modules identified two remaining flaws: non-admin users who reach the else branch in Staff.php when $_REQUEST['staff_id'] is set still overwrite $_SESSION['staff_id'] at line 207, and sibling handlers in SchoolsInfoInc.php and User.php accept caller-supplied school_id and staff_id values without verifying administrator privileges.
Affected: openSIS-Classic <= 9.1 (main branch) · Status: Published (upstream issue open)
Commit 193870b2f938278b27a2d8347bd7e4db5f8f9dfc (PR #3781, fixing CVE-2026-69115) added authverify.CheckAdmin(ctx) to GetPaginationUsers, GetAllUserID, and GetGroups. Verification of sibling RPC handlers in internal/rpc/third/ and internal/rpc/user/ identified four handlers that still omit authverify.CheckAccess or authverify.CheckAdmin: FcmUpdateToken, SetGlobalRecvMessageOpt, UserRegisterCount, and SortQuery.
Affected: open-im-server <= v3.8.3-patch.18 · Status: Published (upstream issue open)
Verification of route authentication wiring in Nightingale alongside CVE-2026-58167 identified datasource query proxy routes registered outside the AnonymousAccess.PromQuerier conditional block without rt.auth() and rt.user() middleware.
Affected: nightingale <= v9.3.0 · Status: Coordinated disclosure in progress
Verification of the upstream fix commits for CVE-2026-56780 and CVE-2026-90910 identified sibling custom actions on Modoboa REST API viewsets that either query global model managers instead of tenant-scoped querysets or rely on default DjangoModelPermissions mappings for custom POST actions.
Affected: modoboa <= 2.7.1 · Status: Coordinated disclosure in progress
Verification of commit a31fa16fb2dc86ab6b0fdc1ee58a204af424f38d (fixing CVE-2026-108692) identified sibling endpoints in CordysCRM's field resolution and reference lookup layer that remained accessible without module read permission or data-scope enforcement.
Affected: CordysCRM <= v1.9.4 · Status: Coordinated disclosure in progress
Verification of commit 42fc3aaa71411daed60544e3b40179c1038bed5d (fixing CVE-2026-109152 in v0.16.2) identified that while file receive operations now check os.path.commonpath against the active receive directory, directory push commands update the active receive directory without enforcing canonical containment.
Affected: scp.py <= 0.16.2 · Status: Coordinated disclosure in progress
Commit 99f4af1153087d335c3e127591d46e8355bc8023 (PR #286, addressing issue #284 / CVE-2026-100391) added _check_not_internal_address() to proxy_forward_endpoint (/proxy/forward) and proxy_stream_endpoint (/proxy/stream), but omitted _check_not_internal_address() from the sibling /proxy/hls/*, /proxy/mpd/*, and /proxy/transcode/* route handlers in mediaflow_proxy/routes/proxy.py.
Affected: mediaflow-proxy <= 2.4.9 · Status: Published (upstream issue open)
Verification of commit 1196561276a3f49da5a714fef89ac9a6c6f9e33b (fixing GHSA-vfjj-gcvv-w248 / CVE-2026-41934 in Vvveb's code editor) identified a mismatch between the code editor's denied-extension list and the shared media trait's upload/rename allowlist, as well as a pre-write check ordering flaw in the file-save handler.
Affected: Vvveb <= 1.0.8.6 · Status: Coordinated disclosure in progress
All vulnerability research published here follows three rules designed for defenders and upstream maintainers.
Every candidate is checked directly against the current upstream default branch, existing issues, pull requests, and published advisories before a report is opened.
When a repository enables GitHub Private Vulnerability Reporting or publishes a security contact in SECURITY.md, we report privately first and withhold unpatched handler details until the fix ships.
Every report includes the exact line numbers, the sibling comparison, and a minimal remediation diff maintainers can apply directly.