漏洞公告

AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping

prebid-server's request forgery vulnerability allows for possible host environment data extraction

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

nanoid: custom generators can loop indefinitely when size is zero

nanoid: non-secure generators can loop indefinitely with negative size

Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type

Req vulnerable to unbounded archive/compression extraction triggered by response content-type

veraPDF Parser DoS via PostScript Type 1 Font Programs

veraPDF Parser DoS via PostScript CMap Streams

veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

veraPDF Validation XXE via Rich Text

veraPDF Validation XXE via XFA

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

swagger-typescript-api vulnerable to code injection via unescaped enum string values

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

goshs has ACL Bypass & Path Traversal

Pagy I18n locale option is not validated before being used in a file path

skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source