Jonatan Männchen / EEF

Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay

Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain

On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding

html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking

html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service

Filter expression injection via forged keyset pagination cursor in Ash