George Chen

Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role

Taubyte Tau v1.1.10 Missing Authorization via GET and DELETE /projects/{id}

Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config

Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service

rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption

Paisa before 0.7.8 Path Traversal via Editor and Sheet API

Decap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching

WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses

ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision

Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router