CVE-2025-30374

CVE-2025-30374 Taipy における RCE、XSS、DoS、認証情報漏えいにつながるクラスポリューション脆弱性 概要 Taipy v4.0.3（発見時点の最新版）において、クラスポリューション脆弱性が確認されました。この脆弱性により、未認証の攻撃者が Taipy サーバー側のランタイムコンテキストを上書きでき、RCE、Reflected XSS、サービス運用妨害（DoS）、機密の認証情報（例: OpenAI トークン）の漏えいなどの深刻な被害を引き起こす可能性があります。 詳細 背景 クラスポリューション（JavaScript におけるプロトタイプ汚染に類似）は、Pyth...

free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

Summary The AUSF component of free5GC stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress...

GHSA-334Q-H5G3-FPXV free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

Summary The AUSF component of free5GC stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress...

PT-2026-53450

Summary The environment variables used during the rendering of the Kubernetes manifest allow YAML injection, enabling attackers to overwrite existing keys like securityContext and inject multi-document YAML to create additional unintended Kubernetes resources. Details The server interpolates...

Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering

Summary The environment variables used during the rendering of the Kubernetes manifest allow YAML injection, enabling attackers to overwrite existing keys like securityContext and inject multi-document YAML to create additional unintended Kubernetes resources. Details The server interpolates...