漏洞公告

Steeltoe's static JWKS cache shared across schemes and never invalidated

Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Steeltoe vulnerable to management-port isolation bypass via spoofed Host header

SimpleSAMLphp has Possible DoS via XPath Transform

Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

Linuxfabrik Monitoring Plugins: Sudoers may be able to obtain privilege escalation via /usr/bin/apt-get arguments

@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation

@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write

9router: Missing Authorization and OS Command Injection

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion

zebrad has unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention

zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector

Mautic has Stored Cross-Site Scripting (XSS) in Projects Component

Mautic has an Authorization Bypass in API v2 Endpoints

Mautic vulnerable to Path Traversal via Campaign Import

Mautic has Server-Side Template Injection (SSTI) in Theme Templates