Vulnerabilidades

*** Pendiente de traducción *** Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test(), an allowed origin appearing only in a source URL's path or query can satisfy image.domains or image.remotePatterns while the URL's actual host remains attacker-controlled. An unauthenticated request to the public /.netlify/images endpoint can therefore cause the Image CDN to request attacker-selected URLs and may probe or reach internal services. Netlify egress protections may constrain reachable targets, and image transformation limits direct response exfiltration; no confidentiality or integrity impact has been demonstrated. This issue is fixed in version 8.2.4.

*** Pendiente de traducción *** MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

*** Pendiente de traducción *** Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.

*** Pendiente de traducción *** LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

*** Pendiente de traducción *** A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component&amp;#39;s i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.<br /> <br /> <br /> Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:<br /> <br /> Product version<br /> Vaadin 23.0.0 - 23.6.13<br /> Vaadin 24.0.0 - 24.9.20<br /> Vaadin 24.10.0 - 24.10.9<br /> Vaadin 25.0.0 - 25.1.11<br /> Vaadin 25.2.0 - 25.2.6<br /> <br /> Mitigation<br /> Upgrade to 23.6.14<br /> Upgrade to 24.9.21<br /> Upgrade to 24.10.10<br /> Upgrade to 25.1.12<br /> Upgrade to 25.2.7 or newer<br /> <br /> Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.<br /> <br /> Artifacts<br /> Maven coordinates Vulnerable versions Fixed version<br /> com.vaadin:vaadin 23.0.0 - 23.6.13 &gt;=23.6.14<br /> com.vaadin:vaadin 24.0.0 - 24.9.20 &gt;=24.9.21<br /> com.vaadin:vaadin 24.10.0 - 24.10.9 &gt;=24.10.10<br /> com.vaadin:vaadin 25.0.0 - 25.1.11 &gt;=25.1.12<br /> com.vaadin:vaadin 25.2.0 - 25.2.6 &gt;=25.2.7<br /> com.vaadin:vaadin-core 24.7.0 - 24.9.20 &gt;=24.9.21<br /> com.vaadin:vaadin-core 24.10.0 - 24.10.9 &gt;=24.10.10<br /> com.vaadin:vaadin-core 25.0.0 - 25.1.11 &gt;=25.1.12<br /> com.vaadin:vaadin-core 25.2.0 - 25.2.6 &gt;=25.2.7<br /> com.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 &gt;=23.6.14<br /> com.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 &gt;=24.9.21<br /> com.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 &gt;=24.10.10<br /> com.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 &gt;=25.1.12<br /> com.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 &gt;=25.2.7<br /> <br /> npm packages<br /> npm package Vulnerable versions Fixed version<br /> @vaadin/charts 23.0.0 - 23.6.4 &gt;=23.6.5<br /> @vaadin/charts 24.0.0 - 24.9.17 &gt;=24.9.18<br /> @vaadin/charts 24.10.0 - 24.10.4 &gt;=24.10.5<br /> @vaadin/charts 25.0.0 - 25.1.11 &gt;=25.1.12<br /> @vaadin/charts 25.2.0 - 25.2.8 &gt;=25.2.9<br /> @vaadin/component-base 24.7.0 - 24.9.17 &gt;=24.9.18<br /> @vaadin/component-base 24.10.0 - 24.10.4 &gt;=24.10.5<br /> @vaadin/component-base 25.0.0 - 25.1.11 &gt;=25.1.12<br /> @vaadin/component-base 25.2.0 - 25.2.8 &gt;=25.2.9

*** Pendiente de traducción *** A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.<br /> <br /> <br /> Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:<br /> <br /> Product version<br /> Vaadin 23.1.0 - 23.6.13<br /> Vaadin 24.0.0 - 24.9.21<br /> Vaadin 24.10.0 - 24.10.9<br /> Vaadin 25.0.0 - 25.1.11<br /> Vaadin 25.2.0 - 25.2.6<br /> Vaadin Framework 7 and 8 with the Spreadsheet add-on 2.0.0 - 3.1.0<br /> <br /> Mitigation<br /> Upgrade to 23.6.14<br /> Upgrade to 24.9.22<br /> Upgrade to 24.10.10<br /> Upgrade to 25.1.12<br /> Upgrade to 25.2.7 or newer<br /> Upgrade the Spreadsheet add-on to 3.1.1<br /> <br /> Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.<br /> <br /> Artifacts<br /> Maven coordinates Vulnerable versions Fixed version<br /> com.vaadin:vaadin 23.1.0 - 23.6.13 &gt;=23.6.14<br /> com.vaadin:vaadin 24.0.0 - 24.9.21 &gt;=24.9.22<br /> com.vaadin:vaadin 24.10.0 - 24.10.9 &gt;=24.10.10<br /> com.vaadin:vaadin 25.0.0 - 25.1.11 &gt;=25.1.12<br /> com.vaadin:vaadin 25.2.0 - 25.2.6 &gt;=25.2.7<br /> com.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.13 &gt;=23.6.14<br /> com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.9.21 &gt;=24.9.22<br /> com.vaadin:vaadin-spreadsheet-flow 24.10.0 - 24.10.9 &gt;=24.10.10<br /> com.vaadin:vaadin-spreadsheet-flow 25.0.0 - 25.1.11 &gt;=25.1.12<br /> com.vaadin:vaadin-spreadsheet-flow 25.2.0 - 25.2.6 &gt;=25.2.7<br /> com.vaadin:vaadin-spreadsheet 2.0.0 - 3.1.0 &gt;=3.1.1

*** Pendiente de traducción *** Improper neutralization of special elements used in an SQL command (&amp;#39;SQL injection&amp;#39;) vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection.<br /> <br /> This issue affects SOPLOG: before Soplog 2026.9.4.1.

*** Pendiente de traducción *** A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Exposición de datos sensibles no autenticada en versiones de MPG menor o igual que 4.2.3.

*** Pendiente de traducción *** Contributor Cross Site Scripting (XSS) in OAuth Server

*** Pendiente de traducción *** Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager

*** Pendiente de traducción *** Contributor SQL Injection in Media LIbrary Assistant