漏洞公告

MCP Toolbox for Databases vulnerable to DNS rebinding attacks

compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal

FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection

Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override

Pimcore has a CustomReports Share Bypass

Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export

AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

Symfony hardened the parser when handling untrusted input

Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint

Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener

Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names

Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address