Open Source Vulnerabilities

github.com/xuri/excelize/v2

Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics in github.com/xuri/excelize

github.com/xuri/excelize/v2

Panic on out-of-order cell column references when reading worksheets in github.com/xuri/excelize

github.com/xuri/excelize, github.com/xuri/excelize/v2

Integer overflow yields an out-of-domain coordinate with nil error, causing panic in github.com/xuri/excelize

github.com/360EntSecGroup-Skylar/excelize/v2, github.com/xuri/excelize/v2

Unbounded <col max> lacks MaxColumns check in flatCols(), causing column mutators to hang or OOM in github.com/xuri/excelize

github.com/360EntSecGroup-Skylar/excelize/v2, github.com/xuri/excelize/v2

Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader in github.com/xuri/excelize

github.com/xuri/excelize/v2

Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref in github.com/xuri/excelize

github.com/360EntSecGroup-Skylar/excelize/v2, github.com/xuri/excelize/v2

Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile in github.com/xuri/excelize

github.com/xuri/excelize/v2

GetConditionalFormats indexes conditional-formatting rule sub-elements with no length / nil check in github.com/xuri/excelize

AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

Dagu MCP DAG specification read bypasses path containment and workspace isolation

FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read

FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read

FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser

FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deployments

FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read on truncated frames

FastNetMon: IPv6 host counters map iterated without lock, racing concurrent inserts

Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)

terraform-provider-netbox

terraform-provider-netbox

Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints

Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator

python-filelock, python-filelock, python-filelock

python-filelock, python-filelock, python-filelock

python-filelock

CVE-2026-112910 affecting package python-filelock 3.20.3-4

lxc, lxc, lxc

Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy

Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines

Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses

Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server

Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation

Rucio: Authorisation Bypass on REST API endpoint for signing URLs

filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

@angular/bazel, @angular/language-service

TuxCare security update for @angular (1 CVE)

filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

@angular/language-service

TuxCare security update for @angular/language-service (4 CVEs)

filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

LXC: lxc-copy host-context hostname update follows symlink

terraform-provider-netbox

terraform-provider-netbox

BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter

@angular/language-service

TuxCare security update for @angular/language-service (4 CVEs)

Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another

kubescape-server

Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation