Fakebug

**Name of the Vulnerable Software and Affected Versions** DTStack Taier version 1.4.0 **Description** An OS command injection issue exists in the REST API component. Remote attackers can exploit this by manipulating the `sqlText` argument passed to the `Runtime.exec()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** YunaiV yudao-cloud version 2026.03 **Description** An issue in the Admin API Endpoint component allows for server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. This occurs through the manipulation of the `IotDataSinkHttpConfig` function within the '/admin-api/iot/data-sink/create' endpoint. The attack can be executed remotely. **Recommendations** As a temporary mitigation, restrict access to the '/admin-api/iot/data-sink/create' endpoint or disable the `IotDataSinkHttpConfig` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FlowCI flow-core-x versions through 1.23.01 **Description** A security flaw exists in FlowCI flow-core-x. The issue resides in the `Save` function within the `core/src/main/java/com/flowci/core/config/service/ConfigServiceImpl.java` file of the SMTP Host Handler component. This manipulation can lead to server-side request forgery, and the attack can be initiated remotely. The exploit is publicly available. The vendor was notified but did not respond. **Recommendations** Versions prior to 1.23.01 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.