offset

Scriban before 7.0.0 Uncontrolled Recursion via object.to_json

Scriban before 7.0.0 Denial of Service via Unbounded Template Output

Scriban before 7.0.0 Denial of Service via string.pad_left/pad_right

Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption

Admidio before 5.0.11 IDOR via save_temporary mylist_function.php

Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect

Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint

AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint