manus-use

webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint

Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data

Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools

Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection

Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service

Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters

Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives

Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout

Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service