漏洞公告

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

LiteLLM: Authenticated command execution via MCP stdio test endpoints

Kratos has a Confused Deputy issue

AstrBot has Incomplete Filtering of Special Elements

PicoClaw has an Injection issue in its Web Launcher Management Plane component

ShowDoc has an Injection vulnerability

simple-git is vulnerable to Remote Code Execution

electerm has Command Injection via runLinux funtion

wlc: print_html outputs API data without HTML escaping

gitverify has improper tag signature verification

Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)

Kyverno Controller Denial of Service via forEach Mutation Panic

Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware

Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width

TYPO3 CMS Stores Cleartext Password in User Settings Module

Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync

k8sGPT has Prompt Injection through its k8sGPT-Operator

Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution

Traefik: Pre-authentication decision bypass due to forwarded alias spoofing

Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication