漏洞公告

MCP Ruby SDK: Ruby SSE Session Poisoning

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

pip would incorrectly handle doubly-encoded package URLs from indexes

mathlive's Lack of Escaping of HTML allows for XSS

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal

netfoil: Incorrect block responses could lead to localhost traffic

Logging operator has Fluentd configuration injection that allows remote code execution

ZITADEL Users Can Self-Verify Email/Phone via API

proot-distro has a Container Isolation Bypass via Crafted Restore Archive

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass

Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network