Michael Holmquist

Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API

RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length

Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration

Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant

Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler

AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint

Unidata netcdf-c through 4.10.1 Out-of-bounds Write via Oversized HDF5 Attribute Name

Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change

ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

Flair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load