Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This

## Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address **before** applying Unicode normalization. An address can contain a Unicode character that is not an ASCII `@` (U+0040) but canonicalizes to one under NFKC/NFKD normalization (the normalization commonly applied by mail libraries and services for internationalized email). Such an address

JupyterLab's PyPI extension manager enforces `blocked_extensions_uris` by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as `JupyterLab.Git` for a blocklisted package such as `jupyterlab-git`; JupyterLab accepts the install request

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead o

Kestra 是一个开源事件驱动编排平台。其本地内部存储后端（local internal-storage backend）在处理用户提供的文件路径时存在路径遍历漏洞。具体而言，后端在将 Windows 风格的反斜杠（\）转换为正斜杠（/）之前，会检查路径中是否包含 '..' 遍历序列。攻击者可以利用反斜杠编码绕过检查（例如使用 '..\..\..\'），因为检查时反斜杠被视为普通字符，而转换后变成 '../../../'，从而绕过安全检查。任何能够查看执行详情的已认证用户（即使是最低权限角色）都可以通过 GET /api/v1/{tenant}/executions/{executionId}/file?path=… 接口读取服务器文件系统中 Kestra 进程可读的任何文件，包括嵌入式 H2 数据库（包含所有流程、用户以及存储的密钥）、其他租户/命名空间的内部存储、挂载的密钥文件以及进程环境变量（/proc/self/environ），其中包含数据库和密钥后端的凭据。此漏洞完全破坏了 Kestra 的存储隔离和多租户边界。受影响的版本为 1.0.45 之前和 1.3.23 之前版本（1.0.x 和 1.3.x 维护分支）。漏洞已在 1.0.45 和 1.3.23 版本中修复。建议所有用户立即升级到修复版本，并在升级前限制对 Kestra API 的网络访问，特别是对执行文件读取端点的访问。

Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety boundary for commands that should require confirmation. Because command strings were checked before ca

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions

### Summary Jupyter Enterprise Gateway has a prohibited UID and GID feature that by default prevents launching kernels with UID or GID 0 (root). This can be bypassed. It is possible to launch kernels with a prohibited UID and/or GID by using a specially crafted `KERNEL_UID` or `KERNEL_GID` value. The feature is described in the documentation: https://github.com/jupyter-server/enterprise_gatewa

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object. Additionally, go-git’s

### Summary An attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. ### Details The vulnerability essentially boils down to the signature being on the canonical RDF graph representation of the JSON-LD document, and