漏洞公告

Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit

go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

Craft Commerce: Partial Payment Amount Without Lower Bound Validation

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text

Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument

Blocky DNSSEC validation bypass and validation-cache scope pollution

UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

Concurrent Ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption

Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity

Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`

Oj: Integer Overflow in Oj.load 2GB String Handling

Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback

Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking

Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling

Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)