漏洞公告

OpenTelemetry.Resources.Azure has an unbounded HTTP response body read

beets has a Cross-site Scripting vulnerability

Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability

Cockpit is vulnerable to arbitrary code execution

Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file

Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test

Jenkins GitHub Plugin has an XSS vulnerability

Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths

Jenkins Credentials Binding Plugin has a path traversal vulnerability

Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources

Spring Framework DoS with Multipart Temp Files in WebFlux

CyberChef has a Cross-site Scripting issue

Duplicate Advisory: Grav has Insecure Deserialization in File Cache

Elastic Package Registry has Improper Verification of Cryptographic Signature

xxl-job has a Resource Injection issue

OpenTelemetry's Zipkin remote endpoint cache could grow without bounds and increase memory pressure

PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer

CoreDNS has TSIG authentication bypass on gRPC and QUIC transports

PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer

CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC

CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass)