漏洞公告

FlowiseAI Exposes Basic Auth Credentials via API

FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment

FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment

FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment

Fleet: IP spoofing allows bypassing API rate limiting

CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration

Strapi may leak sensitive data via relational filtering due to lack of query sanitization

Fleet vulnerable to OS command injection in software packages

Fleet server may terminate unexpectedly when handling certain gRPC requests

Fleet Windows MDM Azure AD JWT Authentication Bypass

Fleet has a rate limiting bypass via untrusted client IP headers

Fleet has a Windows MDM management endpoint authentication bypass

Strapi Upload Plugin MIME Validation Bypass via Content API

Amazon Redshift Vulnerable to Remote Code Execution via Unsafe Class Loading

Absinthe: Quadratic fragment-name uniqueness check

Absinthe: Unbounded atom creation from parsed directive name

Apache Commons Configuration: StackOverflowError for YAML input with cycles

OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices

Grafana: Users can generate Service Account tokens after permissions removal

Cowboy: Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy

Grafana: SQL Expressions Read File From Disk

cowlib: Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame

Strapi: Password Reset Does Not Revoke Existing Refresh Sessions