漏洞公告

praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members

praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

rattler has an entry-point path traversal in noarch:python install (arbitrary file write)

Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

When Vitest UI server is listening, arbitrary file can be read and executed

DOMPurify XSS via selectedcontent re-clone

Nezha's authenticated agents can forge service-monitor results for other users' services

@agenticmail/mcp Missing Authentication for Critical Function

Apache Fesod is vulnerable to Server-Side Request Forgery through its UrlImageConverter component

Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout

Apache Airflow has an Authorization Bypass Through User-Controlled Key

Apache MINA SSHD bundle sshd-git has a path traversal vulnerability

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Exposure of Sensitive Information Through Metadata vulnerability

Apache ActiveMQ server has an incomplete authorization workflow

Apache ActiveMQ has an Incorrect Default Permissions vulnerability

Apache Airflow has no certificate validation on SMTP STARTTLS connections

Apache Airflow: Execution API JWT leaked via KubernetesExecutor worker command-line args

Apache Fluss: Unauthenticated remote attackers can exhaust JVM heap memory using crafted frame headers via TabletServer/CoordinatorServer

Apache Airflow has an Incorrect Authorization issue

Apache Airflow has a Deserialization of Untrusted Data vulnerability

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue