漏洞公告

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

Socket.IO: Engine.IO Polling Transport Connection Exhaustion

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

Directus: Authorization-dependent response served from unsegmented cache key

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection

Guzzle: Proxy-Authorization headers can be sent to origin servers

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

Mistune: Arbitrary File Read via Include directive path traversal

Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

Mistune: XSS via unescaped class option in Admonition directive

Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

js-yaml: YAML merge-key chains can force quadratic CPU consumption

js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses