漏洞公告

eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage

eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check

Statamic CMS: Server-Side Request Forgery via Glide

ImageMagick: Heap Buffer Over-Read in IPTC encoder

Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping

Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass

Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover

Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter

Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs

Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML

Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`

Spring AI MCP Security: Unvalidated URL Fetching (SSRF)

form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys

Graphite Has a Pickle Deserialization Vulnerability

n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters

Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree

iskorotkov/avro: Denial-of-Service Vulnerability in Decoder

SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability

SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket

SGLang: Unauthenticated RCE via --enable-custom-logit-processor

Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint