漏洞公告

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow

Savon::Model evaluates WSDL operation names as Ruby source

Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

Jodit has prototype pollution via Jodit.configure() / ConfigMerge

Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

hashi-vault-js has a path traversal and query parameter injection

dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII

Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook