openziti zrok

• CVE-2026-45576 High 8.3 zrok copy writes attacker-controlled WebDAV paths outside the destination root 0.5%
• CVE-2026-45568 Critical 9.9 zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths 0.5%
• CVE-2026-42275 High 8.7 zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write 0.3%
• CVE-2026-40304 Medium 5.3 zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records 0.3%
• CVE-2026-40303 High 7.5 zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing 0.5%
• CVE-2026-40302 Medium 6.1 zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering 0.2%