KubeVirt live migration opens an unauth backdoor, plus plaintext OAuth tokens in OpenProject

OpenProject's Storages module stores OneDrive/SharePoint OAuth access tokens in plaintext in Rails.cache under a predictable key. None of the supported cache backends (file_store, memcache, Redis) encrypt at rest. If an attacker can read your cache backend (even with a simple anonymous memcached get), they grab a valid Azure AD bearer token and get application-level access to your connected SharePoint/OneDrive.

Affected estate

Teams running self-hosted OpenProject before 17.3.3 or 17.4.1 with OneDrive or SharePoint storage integrations enabled

How to check

Check your OpenProject version in the admin panel or via 'openproject version' on the CLI. Verify whether the Storages module is enabled and connected to OneDrive/SharePoint.

Included because

plaintext credential storage; predictable cache key; unauthenticated cache access possible; CVSS 8.2

Action

Upgrade to OpenProject 17.3.3 or 17.4.1. After upgrading, rotate the Azure AD application client secret and revoke any existing cached tokens. Restrict network access to your cache backend (memcached/Redis).

Why it matters

An attacker who can reach your cache backend recovers a live Azure AD bearer token and gains full application-tier access to your connected SharePoint or OneDrive.

A crafted GPU shader embedded in a web page can trigger an out-of-bounds write in the GPU shader compiler. On platforms where the compiler process runs with elevated system privileges, this could lead to further exploitation beyond just a crash. The trigger is a very small value in shader code that causes the compiler to write past its buffer.

Affected estate

Anyone running browsers or GPU-enabled applications that compile untrusted shader code, especially on platforms where the GPU compiler process has elevated privileges

How to check

Verify your browser version and GPU driver version against the vendor's advisory once published. Check whether WebGPU or shader compilation is enabled in browser flags.

Included because

remote trigger via web page; no user interaction beyond page visit; potential privilege escalation; CVSS 7.7

Action

Apply the vendor's browser or driver update when available. Consider disabling WebGPU in browser settings on sensitive systems as a temporary mitigation.

Why it matters

A malicious web page can crash the GPU compiler or, on certain platforms, escalate to system-level code execution with no user interaction beyond visiting the page.

Envoy's zstd decompressor doesn't limit how much memory a highly compressed zstd payload can expand into. An attacker can send a crafted, small zstd payload that decompresses into a massive memory allocation, OOM-killing the Envoy process and taking down your proxy.

Affected estate

Anyone running Envoy 1.23.0 through 1.35.10, 1.36.0 through 1.36.6, 1.37.0 through 1.37.2, or 1.38.0 with zstd decompression enabled

How to check

Run 'envoy --version' and check whether your listener or HTTP filter config includes a zstd decompressor filter. Review your Envoy config for 'envoy.filters.http.decompressor' with a zstd library reference.

Included because

unauthenticated; internet-facing proxy; denial of service; common infrastructure component; CVSS 7.5

Action

Upgrade to Envoy 1.35.11, 1.36.7, 1.37.3, or 1.38.1. As a temporary workaround, remove or disable the zstd decompressor filter from your config.

Why it matters

A single crafted request can OOM-kill your Envoy proxy, causing a full denial of service for all traffic flowing through it.

Budibase has a public, unauthenticated endpoint that permanently links an external chat identity (Slack, Discord, MS Teams) to a Budibase user account. An attacker creates a link token from their own Slack slash command, then tricks an authenticated Budibase user into clicking the URL. The victim's account silently binds to the attacker's chat identity with no consent prompt and no CSRF protection. The page just says "Authentication succeeded" with no indication of what happened.

Affected estate

Teams running self-hosted Budibase before 3.39.0 with Slack, Discord, or MS Teams chat integrations enabled

How to check

Check your Budibase version in the admin settings. Verify whether chat-link integrations are enabled by looking for active Slack/Discord/Teams configurations.

Included because

unauthenticated endpoint; no CSRF protection; social engineering trigger; account takeover; CVSS 7.3

Action

Upgrade to Budibase 3.39.0. After upgrading, review chat-link bindings in the database for any unexpected external identity associations and remove suspicious entries.

Why it matters

An attacker can silently hijack a user's account by linking their own chat identity to it, gaining persistent access through the chat integration.