| Algorithmic Complexity | |
| Improper Check for Unusual or Exceptional Conditions | |
| Improper Encoding or Escaping of Output | |
| NULL Pointer Dereference | |
| Use of Non-Canonical URL Paths for Authorization Decisions | |
| GHSA-r7wm-3cxj-wff9 | |
| Improperly Controlled Modification of Dynamically-Determined Object Attributes | |
| Incorrect Authorization | |
| GHSA-mhm7-754m-9p8w | |
| CVE-2026-10532 | |
| CVE-2026-9828 | |
| Improperly Controlled Modification of Dynamically-Determined Object Attributes | |
| Incorrect Authorization | |
| Improperly Controlled Modification of Dynamically-Determined Object Attributes | |
| Server-Side Request Forgery (SSRF) | |
| Incomplete Blacklist | |
| Incorrect Authorization | |
| Incomplete Blacklist | |
| Allocation of Resources Without Limits or Throttling | |
| Improper Verification of Cryptographic Signature | |
| Information Exposure | |
| Improper Access Control | |
| Missing Release of Resource after Effective Lifetime | |
| Allocation of Resources Without Limits or Throttling | |
| CVE-2026-42501 | |
| CVE-2026-39825 | |
| Double Free | |
| Out-of-bounds Write | |
| NULL Pointer Dereference | |
| Improper Encoding or Escaping of Output | |
| Link Following | |
| Loop with Unreachable Exit Condition ('Infinite Loop') | |
| Cross-site Scripting (XSS) | |
| CVE-2026-42499 | |
| Uncontrolled Recursion | |