漏洞公告

Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute

Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login

TCC-TRANSACTION has an Improper Input Validation vulnerability

Apache Syncope Vulnerable to Exposure of Sensitive Information Through Data Queries

Apache Syncope has an Improper Isolation or Compartmentalization vulnerability

Duplicate Advisory: Hackney has an Allocation of Resources Without Limits or Throttling vulnerabilit

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability

Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default

Apache ECharts has a cross-site scripting (XSS) vulnerability

Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk

MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled

HuggingFace transformers vulnerable to remote code execution

hermes-agent has a sandbox issue

jasypt-spring-boot Uses a One-Way Hash without a Salt

hermes-agent has an Incorrect Comparison

hermes-agent has an Injection issue

postcss-selector-parser allows denial of service through uncontrolled AST recursion

hermes-agent has an Injection issue

Prefect has an Argument Injection issue

Dolibarr ERP CRM contains a remote code evaluation vulnerability

omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer

omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer