漏洞公告

Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks

json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS

FacturaScripts: Account takeover of any 2FA-enabled user

Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()

DIRAC: SQL injection and lack of access control in PilotManager service

DIRAC: Pilot code downloaded over unverified HTTPS connection

DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

Apollo ConfigService access key authentication bypass via raw config file appId parsing

Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching

NukeViet: Pre-authentication SSRF via X-Forwarded-Host

NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function

NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module

NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

NukeViet: Unauthenticated Reflected XSS in Comment Module

DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input

Decidim: Push subscriptions can be abused for server-side requests

Decidim: HTML content blocks allow stored script execution

Decidim: CSV census record endpoints improper authorization

Decidim: JWT-backed authentication can be replayed across organizations

Decidim: Verification documents can be downloaded through reusable links