漏洞公告

MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS

Kirby: File upload permissions are not checked during processing of chunk data

Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

Duplicate Advisory: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions

Socket.IO: Engine.IO WebTransport SID DoS

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

TYPO3 CMS - Unrestricted File Upload in Form Framework

Duplicate Advisory: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

RestrictedPython guard hooks can be shadowed via positional-only arguments

org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output

org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context

org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

MariaDB has cleartext password disclosure to a MITM on the initial-handshake

Snipe-IT has an Improper Privilege Management issue

MapFish Print has XXE that allows reading arbitrary files of certain types

free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

silverstripe/versioned has XSS in archive admin restore

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read