Lyhtheori

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.

**Name of the Vulnerable Software and Affected Versions** Penpot versions prior to 2.18.0 **Description** The SVG exporter improperly handles the fill-color value of a text object, inserting it into a `ppmcolormask` command string that is then executed via `child process.exec`. An attacker with file editing permissions or one who provides a malicious file via a public share link can inject shell metacharacters into the fill color to execute arbitrary commands with the privileges of the exporter service. **Recommendations** Update to version 2.18.0.

**Name of the Vulnerable Software and Affected Versions** ZITADEL versions 3.x through 3.4.14 ZITADEL versions 4.x through 4.17.0 **Description** An improper authorization flaw exists during the issuance of passkey or passwordless enrollment codes. The system validates the organization specified in the `x-zitadel-orgid` header but fails to verify the organization of the target user. This allows an attacker with user-write permissions in one organization to obtain an enrollment code for a user belonging to a different organization on the same instance, enabling the attacker to register their own authenticator and take over the account. **Recommendations** Update ZITADEL versions 3.x to 3.4.15 or later. Update ZITADEL versions 4.x to 4.17.1 or later.