Zachariah Mithani

docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef

crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool

Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

sqlparse through 0.6.0 PHP Code Injection via output_format='php'

Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields

Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo

doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path

transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath

@offactory/compress-fonts before 1.1.1 OS Command Injection via Font File Names