漏洞公告

AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs

ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

Prompty: Arbitrary file read via file reference expansion

mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath

Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration

Gitea has insufficient permission checks for Composer package source links

TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard

oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code

meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

sh _uid does not drop supplementary groups (incomplete privilege drop)

AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

plone.restapi: Stored XSS by spoofing mime type

plone.app.textfield: Stored XSS by spoofing mime type

Duplicate Advisory: SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

vLLM: Speech-to-text upload size limit is enforced after full UploadFile read

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

vLLM has Remote DoS via Invalid Recovered Token Reinjection

vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models