Zachariah Mithani (AploSec)

billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.

An Otter Wiki before 2.26.2 Stored XSS via Math Code Block

NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid

mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname

@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass

oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension

oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values

Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon

i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl

fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents