漏洞公告

Snowflake Connector for Python improperly verifies TLS hostnames

ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files

@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

ViewComponent: Reused Component Instances Retain Stale Render Context

ViewComponent: around_render HTML-Safety Bypass

open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters

django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization

serde_with: KeyValueMap serialization panics on empty sequence or map entries

websocket-driver: Resource limit bypass via message compression

websocket-driver: Message corruption via abuse of protocol length headers

websocket-driver: Memory exhaustion in HTTP header parser

websocket-driver: Resource limit bypass via message compression

websocket-driver: Memory exhaustion via abuse of protocol length headers

Pixeldrain API key shared with unverified thirdparty sites