漏洞公告

Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)

Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer

Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

Nuxt: Reflected XSS in `navigateTo()` external redirect

ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation

auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs

Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

MCP Registry: OCI validator skips ownership check on upstream rate limits

zrok copy writes attacker-controlled WebDAV paths outside the destination root

go-git: Crafted repositories may modify main and submodule .git directories

gohttp is vulnerable to directory traversal via a crafted request

ModelScope is vulnerable to arbitrary code injection via a crafted module

GlassFish's Administration Console is Vulnerable to RCE

GlassFish's gadget handler is vulnerable to RCE

Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering

go-git: Improper single-quote escaping in go-git SSH transport

rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths

HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover

HAXcms: Private Key Disclosure via Broken HMAC Implementation