漏洞公告

无摘要

无摘要

无摘要

无摘要

无摘要

无摘要

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

Sulu: Stored XSS via media download inline-disposition override

Sulu: Fix authorization bypass when creating preview links

Sulu: Media move/update authorization bypass (IDOR)

ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

Kirby: Access to image files outside of the site root via path traversal in the media handling

Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav: Authenticated ReDoS via regex_replace in Twig Sandbox