漏洞公告

fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

NLTK: Default ENFORCE=False Disables All pathsec Security Controls

NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

Sulu: Stored XSS via media download inline-disposition override

Sulu: Fix authorization bypass when creating preview links

Sulu: Media move/update authorization bypass (IDOR)

ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

Kirby: Access to image files outside of the site root via path traversal in the media handling

Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav: Authenticated ReDoS via regex_replace in Twig Sandbox

qs array-limit bypass via bracket-key comma parsing