漏洞公告

Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing

Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionService

@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch

@steipete/summarize is Vulnerable to Disk Exhaustion via Crafted Media Responses

MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance

Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input

Russh: Unchecked keyboard-interactive prompt count in client auth path

WsgiDAV encoded dot segments can escape filesystem share roots

OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning

DevGuard has improper authorization on public assets

Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks

CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule

Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

@hapi/inert has a static-file confinement bypass via sibling-prefix path

Keras archive extraction utilities allow path traversal and arbitrary file writes

python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood