Schwachstellen, die jetzt zählen.

github.com/kubeflow/pipelines: Kubeflow Pipelines: Information disclosure via SQL injection in pagination token handling

github.com/kubeflow/pipelines: Kubeflow Pipelines: Server-Side Request Forgery via unrestricted pipeline URL fetching

filelock: filelock: unauthorized concurrent access via insecure claim directory permissions

filelock: filelock: Denial of Service (DoS) via symbolic link race condition

filelock: filelock: Denial of Service via Windows opportunistic lock on lock markers

filelock: filelock: Denial of service via pre-created SQLite side files

filelock: filelock: Denial of Service via improper lock file permissions on Windows

@modelcontextprotocol/server: @modelcontextprotocol/server: Information disclosure via shared HTTP transport instance

@modelcontextprotocol/sdk: @modelcontextprotocol/server: Model Context Protocol TypeScript SDK: Denial of service via memory exhaustion from crafted HTTP…

@modelcontextprotocol/sdk: @modelcontextprotocol/client: Model Context Protocol TypeScript SDK: Sensitive information disclosure via cross-origin redirects

@modelcontextprotocol/sdk: @modelcontextprotocol/server: @modelcontextprotocol/express: @modelcontextprotocol/server-legacy: Model Context Protocol TypeScript…

oauthlib: oauthlib: Authentication bypass via missing device code validation

russh: russh: Cryptographic restriction bypass via signature algorithm mismatch

altair: Altair: Cross-site scripting via crafted iframe sandbox URL

### Summary Altair `8.5.7` accepts plugin configuration directly from the `iframe-sandbox` query string. When `plugin_sandbox_opts` contains `type: "scripts"` and an attacker-controlled URL in `scriptUrls`, the sandbox page creates a classic ` ` element and loads the supplied script. In the intended plugin flow, this page runs inside an ` ` without `allow-same-origin`, giving plugin code an opaque origin. However, if a victim opens the crafted sandbox URL directly, that…

@graphql-tools/utils: @graphql-tools/utils: Prototype pollution via unvalidated incremental response path segments

@angular/common: @angular/common: Cross-Site Request Forgery token leakage via URL parsing discrepancy

black: Black: Arbitrary code execution via unvalidated version specification in GitHub Action

github.com/caddyserver/caddy: caddy: Hop-by-hop header leakage via improper protocol upgrade response handling

DSA-6615-1 libreoffice - security update

libreoffice: libreoffice: Denial of Service via crafted dBASE index file

ImageMagick: Mehrere Schwachstellen

ImageMagick: ImageMagick: Denial of Service via infinite loop in SVG decoding

github.com/mark3labs/mcp-go: mcp-go: Unauthorized access via improper OAuth metadata validation

noname: noname: Arbitrary code execution via unauthenticated local file server

accel-ppp: accel-ppp: Denial of Service via heap buffer overflow in logging targets

github.com/goposta/posta: Posta: Server-side request forgery via arbitrary webhook URLs

neuron: neuron: Denial of Service via crafted model dataset

vrpn: vrpn: Denial of Service via out-of-bounds stack write

github.com/authorizerdev/authorizer: Authorizer: Account takeover via password reset poisoning

ingress-nginx: ingress-nginx: Denial of Service via mirror-target annotation

pymodaq: pymodaq_data: pymodaq_gui: pymodaq_utils: PyMoDAQ: Arbitrary code execution via crafted files

h5io: h5io: Arbitrary code execution via crafted HDF5 file