漏洞公告

OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal

Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS

Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection

opentelemetry-go's Schema ParseFile leaks file descriptors on each parse

opentelemetry-go's baggage parsing no longer caps raw header length

Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

Capsule Namespace Hijacking via subresource

Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)

Apache Artemis has an Incorrect Authorization issue

QOS.CH Sarl logback logback-core has a deserialization of untrusted data vulnerability

Apache Ignite REST API Has a Relative Path Traversal Vulnerability

KubeVirt has a Link Following issue

Keycloak has Insufficient Session Expiration

Keycloak Vulnerable to Improper Validation of Specified Quantity in Input

Keycloak has an Out-of-bounds Read

Keycloak has an Authentication Bypass by Primary Weakness

Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition

Keycloak has an Improper Verification of Cryptographic Signature issue

json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio

Keycloak Generates an Error Message Containing Sensitive Information

Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement