漏洞公告

FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint

FacturaScripts vulnerable to stored XSS via product reference in sales/purchases

FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation

FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism

Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint

query-parser-string is vulnerable to Prototype Pollution

parse-ini is vulnerable to Prototype Pollution in index.js()

youtube-regex vulnerable to Regex Denial of Service

Compromised version of intercom-client published to npm

Compromised tag of intercom-php published via GitHub

Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker

BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context

Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL

node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js

next-npm-version is vulnerable to Command injection

Spring Cloud Config Server Logged Sensitive Information

Spring Cloud Config Server Susceptible To TOCTOU Attack

Spring Cloud Config vulnerable to Path Traversal

Spring Cloud Config has an Authorization Bypass Through User-Controlled Key

Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components

Netty MQTT: Resource exhaustion in MqttDecoder