漏洞公告

MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured

Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation

MLFlow Creates a Temporary File With Insecure Permissions

Summarize contains a missing authorization vulnerability

Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links

Summarize contains a path traversal vulnerability

Summarize contains a missing authorization vulnerability

ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.

ImageMagick: Stack overflow in fx operation

ImageMagick: Use-After-Free in MSL decoder.

ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

ImageMagick: Policy Bypass in MNG coder could

ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.

HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()

OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers

OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals