漏洞公告

Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints

FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

Yamcs Vulnerable to LDAP Injection in LdapAuthModule

Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures

XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

Pterodactyl has a database resource limit bypass via race condition in Client API

CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS

XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers

Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview

XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash

Weblate has a Server-Side Request Forgery issue

Duplicate Advisory: gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

vllm has Improper Resource Shutdown or Release

KubeVirt has a Link Following vulnerability

pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

@koa/router has an Access Control Bypass

Blitz has a Cross-site Scripting issue