漏洞公告

Snipe-IT has CSV formula injection in Activity Report export

Yamcs has DOM XSS in Extension Routing

Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

Yamcs has Unauthenticated Directory Traversal

Yamcs has Reflected XSS in the URL of the Authorize Endpoint

Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration

Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key

Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Vikunja has a project duplication bypasses write-permission check on the target parent project

datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS

Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory

Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data