漏洞公告

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

pytonapi has a Webhook Custom Path Authentication Bypass

SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host

OAuth: Cross-origin token-request redirects can expose signed request metadata

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

nono-cli'scregistry pack verification can fail open when provenance metadata is absent

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

@wakaru/cli arbitrary file write during bundle unpack

GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler

lettre has TLS hostname verification disabled when using Boring TLS backend

WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions