漏洞公告

`sui-execution-cut` was removed from crates.io for malicious code

IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users

OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

Pelican Web UI Affected by a Privilege Escalation Attack

phpVMS has an /importer authorization bypass causing full database wipe

AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field

AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration

AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption

AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass

AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations

Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

OpenClaw's Gateway Control UI bootstrap config required Gateway auth

OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes

OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root

changedetection.io project has an XXE vulnerability

Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

CI4MS has a Deactivated User Session Bypass (active=0)

CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess