漏洞公告

Docling: Unsafe URI and Path Handling in HTML Backend

Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands

Docling: Unsafe XML Entity Expansion in USPTO Patent Backend

Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend

Docling: Unsafe Playwright-based HTML Rendering

malla: Stored XSS via Meshtastic node names in multiple frontend pages

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

Froxlor: BIND Zone File Injection via TXT Record Content

quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

AIOHTTP is Vulnerable to Deserialization of Untrusted Data

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

backpack/crud is vulnerable to Cross-Site Scripting (XSS)

Docling: Unsafe Zip Extraction in EasyOCR Model Download

Duplicate Advisory: jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used

GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function

launch-editor vulnerable to command injection via the crafted request on Windows

daphne: WebSocket handshake header smuggling through autobahn splitlines() mishandling of non-standard line separators

Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake

Django: signed cookies are vulnerable to salt namespace collisions

huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path