George Chen

OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

Reconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authentication

JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory

Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml

npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

XAgent Path Traversal Arbitrary File Read via /workspace/file

Cachet 2.4.1 Authenticated Server-Side Template Injection RCE

OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints

Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map

Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop