漏洞公告

Vantage6: No limit on emails sent for password/MFA reset

ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution

decompress: Arbitrary File Write via Archive Extraction (Zip Slip)

Keycloak: Information disclosure due to user profile permission bypass

bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map

OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash

MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle

Supply chain compromise via malicious @cap-js/openapi

Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Shopware: Stored XSS via SVG file upload — no SVG sanitization

Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

Shopware: Admin API ACL Bypass in Order State Transition Endpoints

Shopware SSO referer trust leading to an arbitrary redirect target

Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

Shopware: Admin Account Takeover via User Recovery Hash Exposure

Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section

WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)

WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint