Zachariah Mithani (AploSec)

FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode

jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters

Jan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink

BabelDOC from 0.3.61 before 0.7.0 Denial of Service via ToUnicode CMap Parsing

SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder

An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable src

go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key

Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History

mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects