漏洞公告

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation

Gogs has an Open Redirect via redirect_to

Gogs has the ability to import local repositories via Mirror Settings

Gogs Vulnerable to CSRF Leading to Organization Owner Takeover

Gogs Missing Authorization in Attachment Download

Gogs has Stored XSS in `.ipynb` Preview

Gogs has DoS in rendering issue index pattern

@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields

@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation

Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload

Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens

Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials

Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF

zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet

devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs

scimPatch vulnerable to prototype pollution via unfiltered keys in patch

nebula-mesh's stores enrollment tokens unhashed in SQLite

Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata

skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery

Gogs has SSRF in webhook deliveries

@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets