George Chen

ruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint

Pinpoint - Insecure Session Cookie Attributes in pinpointJwt

Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration

Invidious - Private Playlist Disclosure via Unauthenticated RSS Feed Endpoint

PhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{uid} Endpoint

LibrePhotos < 1.0.0 - Insecure Direct Object Reference in SetPhotosShared Endpoint

Parseable < 2.9.2 - Cleartext Credential Exposure in Notification Target API

Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints

Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override

Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID