آخرین آسیب‌پذیری‌ها

FreeImage through 3.18.0 and danoli3 fork before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder

python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations

CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path

CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action

xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message

Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length

ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM

OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

LangGraph JavaScript custom authentication may permit cross-user Store access

LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Vite: `server.fs.deny` bypassed with queries

Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy

Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

Echo: Static Middleware Double-Unescape Path Traversal

Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization