George Chen

Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity

docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()

Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting

Sigma File Manager through 2.2.0 SSRF via Extension Download Commands

Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset

Vita3K before build 4187 Path Traversal via VPK Package Installation

Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips

Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url

Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding

LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export