漏洞公告

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks

fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`

neotoma has tenant isolation gap in relationship query endpoints

justhtml: to_markdown() code-span blank-line breakout enables XSS

i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string

i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names

OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing

OpenAM Arbitrary OAuth Token Minting via Push Registration

@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write

OpenAM has Unsafe Java Deserialization via SNS

Angular's deprecated package has a Cross-Site Scripting issue

OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration

OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL

Snipe-IT has Improper Authorization in File Deletion (IDOR)

Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation

Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update