漏洞公告

SQL Injection in Geocoder

Denial of Service in Cryptacular

Validation Bypass in schema-inspector

Insecure Deserialization in Apache XML-RPC

Reflected Cross-Site Scripting in Apache CXF

Phar unserialization vulnerability in phpMussel

CSRF issue on preview pages in Bolt CMS

The filename of uploaded files vulnerable to stored XSS

Reflected XSS in GraphQL Playground

Introspection in schema validation in Apollo Server

Use of insecure jQuery version in OctoberCMS

XSS in Django

Data leakage via cache key collision in Django

Regular Expression Denial of Service in websocket-extensions (NPM package)

dom4j allows External Entities by default which might enable XXE attacks

Signature wrapping vulnerability in Spring Security

Directory traversal attack in Spring Cloud Config

Directory traversal attack in Spring Cloud Config

File system access via H2 in Apache Ignite

Django Rest Framework jwt allows obtaining new token from notionally invalidated token

django-nopassword stores secrets in cleartext

SQL injection in Django

Arbitrary shell command execution in logkitty