George Chen

Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update

MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft

DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing

Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml

OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints

Taubyte Tau v1.1.10 Missing Authorization via POST /projects/{id}

XAgent Path Traversal Arbitrary File Read via /workspace/file

Cachet 2.4.1 Authenticated Server-Side Template Injection RCE

Google Turbinia arbitrary command execution

Genkit improper host header validation