GitHub Advisories · reviewed

decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

zip: AES Entry HMAC Authentication Bypass on Premature EOF

zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

Vite: `server.fs.deny` bypassed with queries

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

Keycloak allows unauthorized access to resources via uma permission ticket bypass

Keycloak vulnerable to authorization bypass via incorrect uri comparison

Keycloak: Attacker can re-enable and take over disabled clients via registration access token

@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy

Crass: Non-ASCII characters cause superlinear CPU consumption

Crass: A large number of adjacent CSS comments can trigger a SystemStackError

Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence

@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY