George Chen

CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check

Label Studio through 1.23.0 Cross-Organization Storage URI Resolution

Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change

CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect

Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter

CRMEB through 6.0.0 Unauthorized Message Modification via edit_message

DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid