漏洞公告

Withdrawn Advisory: Open WebUI Allows Admin Deletion via API Endpoint

Withdrawn Advisory: Open WebUI Allows Arbitrary File Write via the `/models/upload` Endpoint

Withdrawn Advisory: Open WebUI Access Control

Withdrawn Advisory: Open WebUI Allows Arbitrary File Write via the `download_model` Endpoint

Withdrawn Advisory: Dask Vulnerable to Command Injection

Duplicate Advisory: Uptime Kuma ReDoS vulnerability

Duplicate Advisory: Qiskit allows arbitrary code execution decoding QPY format versions < 13

Duplicate Advisory: Plenti - Code Injection - Denial of Services

Duplicate Advisory: Keras arbitrary code execution vulnerability

Duplicate Advisory: Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch

Duplicate Advisory: Zip Exploit Crashes Picklescan But Not PyTorch

Duplicate Advisory: Wildfly Elytron integration susceptible to brute force attacks via CLI

Duplicate Advisory: Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis

Duplicate Advisory: Remote Code Execution via Malicious Pickle File Bypassing Static Analysis

Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

Duplicate Advisory: Keycloak allows Incorrect Assignment of an Organization to a User

Withdrawn Advisory: Command injection in Ray

Duplicate Advisory: Authorization Bypass in OPC UA .NET Standard Stack

Duplicate Advisory: Authentication Bypass by Spoofing in OPC UA .NET Standard Stack

Withdrawn Advisory: Sylius allows unrestricted brute-force attacks on user accounts

Duplicate Advisory: Wildfly Server Role Based Access Control (RBAC) provider has Improper Access Control

Withdrawn Advisory: github.com/hashicorp/yamux's DefaultConfig has dangerous defaults causing hung Read

Duplicate Advisory: pimcore/customer-data-framework vulnerable to SQL Injection: Hibernate