漏洞公告

OpenMeter: SQL injection through meter creation

OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks

Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path

milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery

OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake

LMCache: 16-bit multimodal hash collision can poison KV cache entries

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Hono: JWT middleware accepts any Authorization scheme, not only Bearer

epa4all-client: Unauthenticated REST API for Patient Record Writes

Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets

Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS)

Singluarity: Incorrect path matching for 'limit container paths' directive

kas's late signature validation may allow unnoticed repository manipulations

GPTCache: File and image cache keys collide because BufferedReader.peek() only reads the buffered prefix

React Router vulnerable to Denial of Service via reflected user input in single-fetch

Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending

matrix-sdk-ui: Incomplete edit validation

Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Strawberry GraphQL has a Circular Fragment Reference DOS