daw10

Unbounded zlib decompression in Calls SDP WebSocket messages

Server panic via outgoing webhook responses

Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.

Persistent notification timing attack causing server denial of service

Missing authorization check in AI message rewrite endpoint allows access to private thread content

Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access

Insufficient token rotation validation in remote cluster invite confirmation

Instance and webhook GitLab plugin commands were able to be run by non-admin users

Admin RCE via Malicious Plugin Upload on CI Test Instances

WebSocket Message Spoofing via Permalink Embed Manipulation