Vulnérabilités Supply chain

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

lopdf has a stack overflow via deeply nested PDF objects

JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS

Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

gomarkdown/markdown IsSafeURL panics on short URLs

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

SFTPGo source-side file-pattern filter bypass during copy operations

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

containerd: Unpack DoS via repeated opaque whiteouts

Distribution: Client `manifests.Get()` does not verify returned content against requested digest

Qwik: Crashing any Qwik Server via Resource thenable

containerd CRI plugin: Checkpoint restore bypasses destination security context

Backstage: Improper access control in backend action invocation

kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

Appium: Symlink based Zip Slip in @appium/support ZIP extraction

kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

copyparty FTP: upload outside defined volumes (limited path traversal)

Vitess vttablet /twopcz reflected XSS

unstructured: Stored XSS via unescaped HTML generation

mise permits untrusted local configuration to override default shell arguments

kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path