漏洞公告

@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass

@hulumi/drift: Orphan reconciler accepted externally supplied execute plans

@hulumi/baseline: CloudTrail selector tampering events were not fully detected

Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

NocoDB: Stale Auth Cache After API Token Deletion

NocoDB: Attachment Size Limit Bypass via Upload-by-URL

NocoDB: Shared-base link access can invite arbitrary users as persistent base members

NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion

NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags

NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation

NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)

NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL

MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement

SpiceDB: Caveat structures with nested lists can result in improper cache reuse

Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

Snappy: Binary path is never shell-escaped due to an inverted is_executable check

Snappy : SSRF and local file read via the xsl-style-sheet option

Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables

Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read

Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger

Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives

Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers