漏洞公告

Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754

oban_web missing authorization check on `save-job` event handler

oban_web: Unbounded range expansion in cron describe causes memory exhaustion

Probo has an open redirect bypass via path normalization

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape

Fission Container Executor Function PodSpec Injection Leading to Node Escape

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook

Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance

Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration

Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec

Sigstore Java has a vulnerability with bundle verification of integratedTime

@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation