漏洞公告

containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

Oj: Stack Buffer Overflow in Oj.dump via Large Indent

containerd: CRI checkpoint import allows local image tag poisoning

parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied

parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist

symfony/ux-autocomplete: XSS via unescaped AJAX response data

symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted

symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding

symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil

symfony/ux-live-component: XSS via attacker-controlled child component tag

symfony/ux-live-component: Denial of service via unbounded batch action requests

parse-server: Server option routeAllowList is bypassable through batch sub-requests

containerd image-triggered runtime DoS via unbounded group parsing

Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle

ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor

py7zr: Arbitrary File Write Vulnerability

TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)

Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)

AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content

Hugo: Symlink confinement bypass in os.ReadFile

Hugo: XSS via unescaped code-fence language in default code block renderer

OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source