漏洞公告

Drupal core third-party PEAR Archive_Tar library is vulnerable to Deserialization of Untrusted Data

Invalid HTTP method overrides allow possible XSS or other attacks in Symfony

User enumeration leak using switch user functionality in Symfony

Argument injection in a MimeTypeGuesser in Symfony

Symfony Unsafe Cache Serialization Could Enable RCE

Arbitrary File Write in iobroker.js-controller

Data leakage via SQL Injection in Pimcore

Prototype Pollution in chartkick

typed-ast Out-of-bounds Read

typed-ast Out-of-bounds Read

2FA bypass in Wagtail through new device path

Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript

Cross-Site Scripting in vant

Apache Airflow vulnerable to XSS and local file disclosure

SQL Injection in usmanhalalit/pixie

angular Prototype Pollution vulnerability

XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue

XXE in PHPSpreadsheet due to encoding issue

user/group information can be corrupted across storing in fsimage and reading back from fsimage

Uncontrolled deserialization of a pickled object in rediswrapper allows attackers to execute arbitrary scripts

Duplicate Advisory: Possible remote code execution via a remote procedure call

Timing attacks might allow practical recovery of the long-term private key

Potential to access user credentials from the log files when debug logging enabled