漏洞公告

Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

swift-nio-http2: Missing CR/LF/NUL validation in header values

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics

Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

Budibase: SSRF via DNS rebinding in the REST datasource integration

Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

Budibase: Account Enumeration via Login Lockout Response Differential