Michael Holmquist

RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length

Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant

Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values

Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration

Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler

AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint

Unidata netcdf-c through 4.10.1 Out-of-bounds Write via Oversized HDF5 Attribute Name

Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change

ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

Flair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load