漏洞公告

multiparty vulnerable to ReDoS via filename parsing

multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing

multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception

Sulu: Used API Keys may be available via Admin API

Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351

Formie: Pre-authenticated server-side template injection in Hidden fields

TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection

@tmlmobilidade/utils has prototype pollution in its setValueAtPath

LibreNMS: Cross-Site Scripting in ShowConfigController

dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport

parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names

async-http-client: Cookie header not stripped on cross-origin redirect

Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption

shopper/framework: Authorization bypass in multiple Livewire admin components

iskorotkov/avro: CPU Exhaustion in Decoder

CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

iskorotkov/avro: Integer Overflow in Decoder

brace-expansion: Large numeric range defeats documented `max` DoS protection

CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations

CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule

Microsoft DirectX12: .spritefont multiply overflow only in 32-bit builds