漏洞公告

Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change

Talos Linux has a local privilege escalation from untrusted workloads

Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users

Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components

katalyst-koi: Session cookies can be replayed after user logout

Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information

go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth

CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content

Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover

rust-zserio has Unbounded Memory Allocation

Free5GC AMF Bypasses UE Security Capabilities on NGAP PathSwitchRequest

Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

container: pf Rule Injection via Domain Name Argument in `container system dns create --localhost` Command

Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

Rancher Extensions have arbitrary file access via path traversal

Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure

Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme

Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine

Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes