hieuPenguinnn

MP Manager through 1.1.0 Path Traversal via Archive Extraction sanitizeEntryName Bypass

XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint

Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download

ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials

Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface

Predibase LoRAX through 0.12.1 API Token Exposure via Router Logs

UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app

hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins

Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution

KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name