漏洞公告

Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion

Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

Wasmtime: Memory leak in C API with `externref` and `anyref` types

FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`

FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities

Duplicate Advisory: TYPO3-CORE-SA-2026-020: TYPO3 CMS - Unrestricted File Upload in Form Framework

Keras: tar extraction permits symlink-based path traversal

SAP Approuter Vulnerable to HTTP Request Smuggling

SAP Approuter has an Open Redirect vulnerability

Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP

crewai-tools SSRF redirect bypass exposes internal services

Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes