漏洞公告

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Silverstripe: XSS in breadcrumbs in page list view

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Nx: Zip-Slip in the self-hosted remote cache

Mermaid radar diagrams are vulnerable to DoS

Mermaid configuration APIs allow prototype pollution

Mermaid allows CSS injection applying to sibling elements of the diagram

Mermaid Architecture diagrams are vulnerable to prototype pollution

Contao: Possible path traversal in job download URIs

Mermaid XY Charts are vulnerable to an infinite loop DoS

Contao crawler leaks auth credentials to external hosts

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Statamic: Account takeover via OAuth email matching without email-verification check

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass