Xoán M. Otero Jorge

Missing ownership check on the shared memory object named by the kitty askpass escape code

Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer

Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop

Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell

Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory

Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process

IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers