manus-use

crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

SiYuan before v3.8.2 Path Traversal via removeRiffDeck

AVideo through 29.0 Information Disclosure via stats.json.php

AVideo through 29.0 Unauthenticated Disclosure via epg.json.php

commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API

GitPython before 3.1.59 Arbitrary File Read via TagReference.create

GitPython before 3.1.59 Arbitrary File Read via Repo.blame()