漏洞公告

sigstore-go has a multi-log threshold bypass via single compromised log

Rattler vulnerable to package cache path traversal via conda package build string

OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect

mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS

mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)

mint: Content-Length header accepts non-RFC "+" sign prefix

mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`

pypdf: Possible infinite loop when processing threads/articles in writer

Sylius: IDOR on Shop Payment Request API endpoints

Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

Sylius: Cart FormComponent allows modification or deletion of an already-completed order

YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service

YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize

YesWiki has Authenticated SQL Injection via ReactionManager

YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes

YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`

YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))

YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters

YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`

YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read