George Chen

react-admin before 5.15.5 Stored XSS via UrlField and FileField

RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors

NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis

GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs

KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch

Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records

BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys

OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions

Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration

Yank Note before 3.93.1 Path Traversal via /api/help Endpoint