آخرین آسیب‌پذیری‌ها

Echo static file middleware route protection bypass via encoded dot-dot traversal

Kserve: kserve: server-side request forgery via malicious storageuri

Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools

Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI

Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)

Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Secret masking bypass in the environment tool in Strands Agents Tools

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS

Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution

Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products

Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources

Samba: access control bypass via vfs_ceph_rgw case-insensitive open

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

Echo: WebSocket proxy can retain connections and handlers after client disconnect

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename

Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication

EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex