Yu Sun

XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py

manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model

ai-goofish-monitor Unauthenticated Arbitrary File Read via GET /api/prompts/

Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text

FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py

Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings

Gradio < 6.15.0 Cookie Injection via Shared Proxy Client

Agent Zero < 1.15 Stored XSS via image_get API Endpoint

Agent Zero < 1.15 Path Traversal File Read via image_get API

DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py