漏洞公告

Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop

Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability

NLTK vulnerable to Eval Injection via collocations CLI arguments

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

etcd: Watch API authorization bypass via open-ended range requests

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

libp2p: yamux connection DoS via oversized data frame

Quasar: Prototype pollution in the extend() utility

Oh My Posh: Arbitrary command execution via template injection in the path segment

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

OmniFaces: Forged combined-resource IDs and related output/push boundaries

Shescape: Quadratic-time denial of service in the flag-protection

Shescape: Home-directory disclosure in assignment context on Unix with Dash

Shescape: Shell injection via unescaped parentheses on Windows with CMD

Shescape: Path disclosure on Unix with Zsh

AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

blaze: Unbounded WebSocket message aggregation in http4s-blaze-server