漏洞公告

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

aiosmtplib: STARTTLS response injection

WebOb: Open redirect in Location header normalization via leading C0 control / space characters

Duplicate Advisory: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input

Duplicate Advisory: Model-artifact APIs bypass pathsec and touch files outside allowed roots

Duplicate Advisory: Downloader.download follows hardlinks and overwrites outside-root files

Duplicate Advisory: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks

Duplicate Advisory: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Duplicate Advisory: Quadratic-time DoS in PorterStemmer via long runs of 'y'

Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

libreoffice-convert vulnerable to path traversal / arbitrary file write

silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)

cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

silverstripe/userforms vulnerable to remote code execution via userforms email subject

Silverstripe Framework: Possible XSS attack through media embed

OpenSTAManager has HTML Injection in modules/utenti/edit.php

LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates

asyncssh has SCP Path Traversal to Arbitrary File Write

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution