漏洞公告

Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation

Keystone vulnerable to `graphql.maxTake` bypass with negative `take`

Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin

Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

Wagtail: Improper restriction handling on Page translation API endpoint

Wagtail: Improper permission handling when copying snippets

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

Wagtail: Identification of documents by SHA1 hash

Winter: Reflected XSS through the search query parameter in the backend Table widget

Winter: CSRF through AJAX handler names reachable as backend page actions

Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

Winter: ImportExportController AJAX handlers bypass granular import/export permission gate