漏洞公告

Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation

Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass

phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

WsgiDAV MySQL provider has a blind SQL injection

Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields

Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update

Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Snipe-IT has CSS Injection via `header_color` Setting

Snipe-IT has incorrect permission for legacy license checkin API

Snipe-IT has missing object-level authorization in Kits API

Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter

Snipe-IT's import created_by can be overwritten

Snipe-IT vulnerable to directory traversal in displaySig

Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Snipe-IT has a path traversal vulnerability via CSV import `image` field

Snipe-IT vulnerable to stored XSS via inline-served attachment

Snipe-IT vulnerable to stored XSS via Markdown custom field

Snipe-IT has an authorization bypass on print inventory page