manus-use

Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange

Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh

Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable

ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure

Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter

webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint

Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data