漏洞公告

SurrealDB has unauthenticated remote DoS via malformed RPC `use` call

SurrealDB has Denial of Service in JSON parser due to nested objects

SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation

SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers

sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced

sigstore-js has Insufficient Verification of Data Authenticity

CrateDB's Blob HTTP handler bypasses authorization

Kimai Password Reset Link Remains Valid After Password Change

repomix: attach_packed_output can bypass file-read secret scanning for supported local files

Concourse login flow has an open redirect issue

repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection

pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts

Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries

Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`

Schema.org has cross-site scripting (XSS) via script break-out in toScript() output

Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service

Keras: HDF5 virtual datasets can disclose local files

wetty vulnerable to DOM XSS via file-download filename

EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components

auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback