Xoán M. Otero Jorge

Unescaped header separators in whatstk build a regular expression that backtracks exponentially

Silent loss of messages when merging overlapping chat exports in whatstk

Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts

Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries

Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier

Account pre-hijacking in the Prowler API through email based social account linking without verification

Missing ownership check on the shared memory object named by the kitty askpass escape code

Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer

Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop

Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell