George Chen

OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri

IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

StarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized Views

Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration

ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision

Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI

Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client

one-api through 0.6.10 Missing Authorization on URL-Parameter Channel Pinning