Security Fixes: CVE 2026.7.14–17

Technology 2026-07-17T18:56:16.430Z Morota loves to watch Lily help her

.env environmental variable leaks docker-compose.yml leaks package.json leaks JSON repeat-key radiation interface CSRF error information leaks origin.yachiyo.hk Source site exposure failure returns full volume data 5MB robots.txt leaks leaking path JSON invalid identification can result in an article-injecting attack

.env environmental variables leak
docker-compose.yml leak
Package.json
JSON Repeated Key Radiation All Station Interface
CSRF Error message leak
Origin.yachiyo.hk Source Station Exposure
Page break returns full volume 5MB
robots.txt leak hidden paths
JSON's invalid identification allows the article to be poisoned.
Message can release a fishing URL direct deployment.
The head can PUT directly to the outside URL to enable the deployment of the picture horse
SPF Missing
WebSocket does not support
HTTP/2 Not supported
TLS 1.3 Configuration
The head is missing more than one.
SSRF parameters are manageable (room/world?city=)
CSRF circumventable (GET request)
The horse can be triggered by the SVG/Message link
CSP Missing
DMFAS Missing
DKIM Missing
SameSite Cookie not set
X-Frame-Options Missing
X-Content-Type-Options Missing
Referrer-Policy Missing
Missing missions-policy

View comments and participate in discussions