George Chen

Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log

LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification

NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields

Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation

Mopidy before 4.0.5 Path Traversal via File Backend library.lookup

Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation

Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd

AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var

OpenRefine through 3.10.1 CSRF to RCE via get-rows Command

ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter