漏洞公告

OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer

OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints

rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding

utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables

mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening

Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft

OSGeo GDAL vulnerable to out-of-bounds read

OSGeo GDAL vulnerable to heap-based buffer overflow

Postorius is vulnerable to XSS

Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfo

Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

Ech0 comment model's Email field returned on public /api/comments endpoints

Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery

Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution

Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy

Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs

Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer

Zebra Vulnerable to Allocation Amplification in Inbound Network Deserializers