آخرین آسیب‌پذیری‌ها

Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data

Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters

ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)

AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change

fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall

mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation

Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler

GeoNetwork: Reflected XSS through client-side template injection

Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views

Netcore NBR100V2 auto_ac msg_aes_dec integer overflow

GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field

MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata

Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering

remote abort and memory disclosure from a malformed cursor.ns

MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password

MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)

traQ: Privilege escalation by OAuth prompt=none request

Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret

Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

traQ: XSS in the User Uploaded File Retrieval API

Logging Redactor: PII data in str/repr of non primitive objects was not being redacted

OPNsense: Configuration line injection via multiple GUI text fields