漏洞公告

Duplicate Advisory: Axios: Nested axios option objects can consume polluted prototype values

Duplicate Advisory: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Duplicate Advisory: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

Duplicate Advisory: Axios: Excessive recursion in formDataToJSON can cause denial of service

Duplicate Advisory: Axios: Prototype pollution gadgets can alter axios request construction

Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Duplicate Advisory: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Duplicate Advisory: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Duplicate Advisory: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Duplicate Advisory: Axios: Prototype pollution auth subfields can inject Basic auth

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

guard-livereload has a directory traversal vulnerability

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

core-geonetwork has an Open Redirect Bypass

Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message

Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

sigstore-go fails to check signature timestamps against a signing key's validity period

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure