漏洞公告

Flask-Security has an Open Redirect issue

Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree

Filament: Unauthenticated temporary file upload on auth pages

opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

Snipe-IT's selectlist visibility is too permissive

phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation

Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS

Filament: Timing-based user enumeration on login page

Slim has Reflected XSS in the HtmlErrorRenderer

Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

jackson-databind has @JsonView bypass for setterless creator properties

jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields

jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation

jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

jackson-databind has a @JsonView bypass for unwrapped creator parameters