آخرین آسیب‌پذیری‌ها

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

dd-trace: ReDOS in URL query string obfuscation

MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules

Lenient parsing of integers for response body and chunk framing

MLflow CrewAI autologging records LLM provider API keys in logged trace spans

Sunhillo SureLine Authentication Bypass via Session Cookie

Sunhillo SureLine OS Command Injection via networkDiag.cgi

Sunhillo SureLine Path Traversal via radarUpdater.cgi

MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source

follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

CKEditor: Cross-site scripting (XSS) in the engine package

CKEditor: Cross-site scripting (XSS) in the engine package

Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API

Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

Matrix homeserver could redirect the chat session to a local file or network share