漏洞公告

RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API

RabbitMQ has predictable credential obfuscation seed value used in Shovel and Federation plugins

Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing

Duplicate Advisory: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

OpenAM OAuth Authorization Bypass via PKCE Challenge

OpenAM OAuth Client Impersonation via JWKS Resolver Cache

OpenAM Authenticated RCE via Groovy Sandbox Escape

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

pnpm: `patch-remove` could delete project-selected files outside the patches directory

pnpm: Hoisted install imports lockfile alias outside node_modules

Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API

pnpm: `stage download` writes outside its destination directory via manifest name/version traversal

pnpm: Reserved bin name deletes PNPM_HOME during global remove

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists

gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

ImageMagick: Memory Leak in wand option parser when providing invalid arguments