漏洞公告

ps_checkout allows unauthorized method invocation through unvalidated parameter

Contras Affected by CopyFile Policy Subversion via Symlinks

Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation

Sentry's improper authentication on SAML SSO process allows user identity linking

OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter

Shopizer is vulnerable to Cross-site Scripting

Shopizer has a path traversal issue

Krayin CRM allows a remote attacker to execute arbitrary code via compose email function

ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction

Clerk has an authorization bypass when combining organization, billing, or reverification checks

n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders

Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation

CKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`

Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

Weblate Doesn't Invalidate API Token on Password Change

Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)

Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL

Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection

Keycloak has a Forced Browsing issue

apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider

django-mdeditor is Missing Authentication for Critical Function