漏洞公告

无摘要

无摘要

无摘要

无摘要

无摘要

无摘要

无摘要

无摘要

无摘要

无摘要

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

YOURLS has stored XSS in referrer statistics chart via crafted Referer header

JSONata: Arbitrary Code Execution via crafted JSONata expressions

kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation

Keystone vulnerable to `graphql.maxTake` bypass with negative `take`

Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers