漏洞公告

无摘要

无摘要

无摘要

logto-tunnel serves files outside --experience-path via path traversal

BuildKit has a possible runtime DoS via unbounded group parsing

BuildKit: Custom frontend could bypass Seccomp/AppArmor

SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Snipe-IT: Stored DOM XSS via table selected-count IDs

Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode

GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

SearXNG MCP Server: Additional hardened-mode SSRF bypasses

SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS

block_buffer: panic corrupts inline buffer position