alimony

OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key

SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass

Grav before 2.0.15 Stored XSS via audio/video source URL

GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()

Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply

Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

@fastify/static vulnerable to route guard bypass via non-canonical path segments