George Chen

AutoBangumi < 3.2.8 - SSRF via /api/v1/setup/test-downloader

LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations

Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure

LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search

Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets

Dapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-Host

LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl

Pathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Document Store

Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment

JuiceFS - Authentication Bypass via pprof and metrics Endpoints