Schwachstellen, die jetzt zählen.

nvm: nvm: Information disclosure via command-line credential exposure

nvm: nvm: Arbitrary command execution via unvalidated mirror data in shell arithmetic

proxysql: proxysql: Information disclosure via unverified compressed payload length

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length equals the attacker-controlled payload_length. An authenticated MySQL client that negotiates compression can overstate payload_length, causing buffer2array() to parse the uninitialized tail of a heap buffer as MySQL…

github.com/telepresenceio/telepresence: Telepresence: Information disclosure via unauthenticated Traffic Manager API

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only the ManagesNamespace manager watchlist check, and CreateIntercept can target any managed namespace without checking the session's Kubernetes RBAC. An attacker operating any pod with network access to the manager can…

github.com/go-chi/chi: go-chi: Open redirect via encoded tab characters in RedirectSlashes middleware

joi: joi: Prototype pollution via untrusted message configuration

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.

github.com/telepresenceio/telepresence: Telepresence: Unauthorized network routing access via missing session ownership verification

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient…

nexus: Sonatype Nexus Repository: Information disclosure via internal REST endpoint

nexus: nexus: Database modification via SQL injection in reindex task

nexus: nexus: Information disclosure via improper group repository authorization

nexus: nexus: Authentication bypass via Rut Auth capability creation

nexus: nexus: Information disclosure of private signing keys to read-only users

firecracker: firecracker: Unauthorized host memory access via failed memory remap

Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping. To remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later.

Yealink: Yealink: Information disclosure via improper access control in Wi-Fi 802.1X configuration

Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default.

DSA-6617-1 symfony - security update

symfony/http-client: symfony/http-client: Information disclosure via relative URL handling

GNU libc: Schwachstelle ermöglicht Denial of Service

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

com.fasterxml.jackson.dataformat/jackson-dataformat-cbor: jackson-dataformat-cbor: Denial of Service via unbounded CBOR tags

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven). PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo. Quadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File…

github.com/coder/coder: Coder: Unauthorized upstream provider access via path traversal in AI Gateway

Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key.

github.com/traefik/traefik: Traefik: Unauthorized access via shared authentication connection pool

freerdp: freerdp: Arbitrary code execution via RD Gateway RPC client heap buffer overflow

freerdp: freerdp: Denial of Service via dynamic audio channel use-after-free

freerdp: freerdp: Denial of Service via heap buffer overflow during Early User Authorization

freerdp: FreeRDP: Denial of Service via dynamic channel race condition in proxy

freerdp: freerdp: Denial of Service via missing negotiation tokens in CredSSP request

freerdp: freerdp: Denial of Service via infinite loop on truncated WebSocket frame

freerdp: FreeRDP: Heap-based buffer overflow via surface key truncation in RDPGFX

FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS.

freerdp: freerdp: Memory corruption via race condition in planar bitmap decoding

FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.

freerdp: freerdp: Denial of Service via crafted Kerberos authentication request

freerdp: freerdp: Denial of Service via use-after-free in smartcard emulation

freerdp: freerdp: Denial of Service via heap out-of-bounds write in planar codec