Naoyashiga

**Name of the Vulnerable Software and Affected Versions** NocoDB versions prior to 2026.04.1 **Description** A reflected Cross-Site Scripting (XSS) issue exists in the Page Leaving Warning page. The application reads the `ncRedirectUrl` and `ncBackUrl` query parameters from the route query without proper validation. These parameters are used in `window.location.href` and `<a>` tag bindings. When the `isSameOriginUrl()` function returns false, which occurs with `javascript:` URIs, the raw URL is assigned to `window.location.href`, allowing the execution of arbitrary JavaScript in the context of the application. This can be triggered by sending a crafted link to a victim and does not require authentication. **Recommendations** Update to version 2026.04.1.

**Name of the Vulnerable Software and Affected Versions** RustFS versions prior to 1.0.0-alpha.83 **Description** RustFS is a distributed object storage system built in Rust. A Stored Cross-Site Scripting (XSS) vulnerability exists in the RustFS Console, allowing an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an attacker can steal administrator credentials from `localStorage`, potentially leading to full account takeover and system compromise. The vulnerability is due to improper validation of the response content type during the file preview process and a lack of origin separation between the S3 object delivery and the management console. An attacker can upload a file with a malicious payload disguised as a PDF, which, when previewed, executes JavaScript code with unrestricted access to the parent window's `localStorage`. This allows the attacker to steal S3 credentials (AccessKeyId, SecretAccessKey, and SessionToken) and perform administrative actions. Approximately 25,000 services are estimated to be found yearly that are potentially affected. **Recommendations** Update to version 1.0.0-alpha.83 or later.

**Name of the Vulnerable Software and Affected Versions** Static Web Server versions 2.1.0 through 2.40.1 **Description** Static Web Server (SWS) has a timing-based username enumeration issue in Basic Authentication. The server checks if a username exists before verifying the password. Valid usernames trigger a slower code path, such as bcrypt hashing, while invalid usernames receive an immediate 401 response. This timing difference allows attackers to identify valid accounts by measuring response-time differences, enabling targeted brute-force or credential-stuffing attacks. The server validates the provided `username` before password verification. An attacker can distinguish between existing and non-existing accounts by analyzing response times to the authentication endpoint. **Recommendations** Versions 2.1.0 through 2.40.1 should be updated to version 2.41.0 or later.