offset

Scriban before 7.0.0 Denial of Service via Unbounded Template Output

Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption

Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect

justhtml before 1.12.0 Mutation XSS via Raw Text Elements

DOMPurify before 3.4.9 Trusted Types Policy State Contamination

DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage

Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint