漏洞公告

phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration

phpMyFAQ: Default Empty API Token Authentication Bypass

phpMyFAQ: IDOR Account Takeover

phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation

Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows

Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification

Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage

wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

Plug: Unbounded buffer accumulation in multipart header parsing causes denial of service

Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS

Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions

Setup PHP: Command Injection in Repository-Derived PHP Version Resolution

Diffusers: TOCTOU Trust Remote Code Bypass

RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM

Drupal core allows Object Injection

Drupal core allows Cross-Site Scripting (XSS)

Drupal core is Vulnerable to Cross-Site Scripting

Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

@angular/platform-server: SSRF via Hostname Hijacking