漏洞公告

Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool

i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters

netfoil's optional seccomp sandboxing was not applied

Netfoil has incorrect allowlist enforcement

pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider

Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer

Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation

Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest

Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests

Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send

Admidio Missing Minimum Administrator Check in Role Membership Removal

Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion

Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP

Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment

Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items

Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php

Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read

Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials

OpenClaw: Webchat audio embedding could read local files without local-root containment

mcpo-simple-server has a Path Traversal issue

OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners

n8n has XML Node Prototype Pollution that to RCE