漏洞公告

Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema

Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

Appsmith Super User Creation Race Condition Allows Multiple Instance Administrators

Budibase: Unvalidated VectorDB Host Parameter Enables SSRF

Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker

GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection

Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step

SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec

NIOExtras: NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Length

SwiftNIO NIOHTTP1: HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS

SwiftNIO: Out-of-bounds write via ByteBuffer index and length UInt32 overflow

SwiftNIO: CRLF Injection in outbound HTTP request URI via NIOHTTPRequestHeadersValidator

LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()

Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

Apache cxf-core: No restriction on attachment headers per message

Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory

Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection