漏洞公告

free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating

free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler

free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions

free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types

free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)

free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)

free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference

free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)

free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path

free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)

free5GC's BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions

free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference

free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference

free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits

Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal

Open WebUI has Improper Authorization Control

Open WebUI has stored XSS in Excel file preview

Snipe-IT has Privilege Escalation via API Permissions Assignment

in-toto-golang and in-toto-python have inconsistent negation behavior

Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)

Kimai has an arbitrary file read in its invoice PDF renderer (admin)