漏洞公告

PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes

Hackney has unbounded buffer accumulation in WebSocket

Hackney has CRLF / header injection in WebSocket upgrade request

Hackney has CR/LF injection in query parameter

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body

Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host

Hackney has CRLF / header injection via unvalidated `domain` and `path` options

Hackney: `ssl:connect/2` post-handshake upgrade has no timeout

Hackney has an infinite loop on non-token byte at start of an Alt-Svc entry

Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication

Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

Cargo crates in third party registries can override the cached source of other crates

Cargo can be coerced to share credentials between registries

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url

mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

Relyra SAML SignatureValue not cryptographically verified -> authentication bypass