漏洞公告

daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames

Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary

ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReader

Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass

MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration

DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption

Code Index MCP is vulnerable to Uncontrolled Resource Consumption

DesktopCommanderMCP is vulnerable to SSRF

OpenMed vulnerable to remote code injection through privacy-filter model loading path

Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()

Apache Calcite is Vulnerable to Use of Externally-Controlled Input to Select Classes

Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'

MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions

FoundationAgents MetaGPT: Deserialization through flawed argument mapping via Message.check_instruct_content()

SGLang: Reachable Assertion via  lora_path  in LoRAManager enables remote Denial of Dervice

Claw Orchestrator has inefficient regular expression complexity via validateRegex()

Nanobot contains a server-side request forgery vulnerability in the web_fetch tool

Spring Cloud Function Context has Uncontrolled Recursion

Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry

Claw Orchestrator is missing authentication for the component API Endpoint

pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

Logback vulnerable to Object Injection through HardenedObjectInputStream modules

kas checks out SHA-like git branches as valid commits