漏洞公告

@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state

@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection

@asymmetric-effort/specifyjs: URL parse failure silently allows request

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function

Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload

Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

Langroid: Path traversal in the file tools allows read/write outside configured current directory

Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect

OpenClaw: Native command authorization could skip owner-command enforcement

OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

OpenClaw: Trusted retry endpoint checks could match hostname prefixes

OpenClaw: Telegram interactive callbacks could skip commands.allowFrom

Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set

Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

OpenClaw: Matrix allowFrom could bind to mutable display names

OpenClaw: Mattermost slash token revocation could lag until monitor refresh

OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance

OpenClaw: Combined POSIX shell options could confuse exec revalidation