漏洞公告

rustls-webpki: Denial of service via panic on malformed CRL BIT STRING

Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover

Kimai has Missing Object-Level Authorization in the Team API

LiteLLM has SQL Injection in Proxy API key verification

Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars

Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization

Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

LiteLLM: Server-Side Template Injection in /prompts/test endpoint

nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields

AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache

Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler

RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

liquidjs has a Denial of Service via circular block reference in layout

Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions

Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

Lemmy has SSRF in /api/v3/post via Webmention dispatch

Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image