漏洞公告

FileBrowser Quantum: unauthenticated user share share info

CamoFox MCP: Unauthenticated HTTP MCP browser-control surface

SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser

SQLFluff: Recursive Stack Overflow in Parser

SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl

Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal

Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint

HAX CMS: Denial of Service using Malicious Import Request

OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle

rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

Turbo: Login callback CSRF/session fixation

Turbo: Unexpected local code execution during Yarn Berry detection

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`

Diesel: Possible unaligned data access for implementations of `SqliteAggregate`