Findings

Audit findings.

Real bugs, not vibes — the security regressions Sebastion catches in live open-source code. Every finding maps to a CWE and is ranked by severity, then published in the open so you can see exactly what a security-first review surfaces before code ships.

1001 findings across 288 repositories — 80 critical, 364 high, 522 medium, 35 low.

Findings come from automated audit runs across public repositories, grouped by scanner severity. They have not all been individually triaged or acknowledged by maintainers; CVE numbers are assigned only after coordinated disclosure where applicable.

Medium

50 on this page

infiniflow/ragflow

XSS in OAuth popup via unescaped payload_json in HTML script tag

CWE-79api/apps/restful_apis/connector_api.py

2026-05-25

ltaoo/wx_channels_download

Authentication bypass when token database is empty

CWE-287internal/officialaccount/worker/index.js

2026-05-25

ltaoo/wx_channels_download

XSS via XML injection in RSS feed generation

CWE-611internal/officialaccount/worker/index.js

2026-05-25

NVlabs/Sana

Shell command injection via URL string formatting in download handlers

CWE-78diffusion/data/wids/wids_dl.py

2026-05-24

OpenSignLabs/OpenSign

Unauthenticated user ID enumeration via getUserId cloud function

CWE-862apps/OpenSignServer/cloud/parsefunction/getUserId.js

2026-05-24

OpenSignLabs/OpenSign

Unauthenticated contact record access via getContact cloud function

CWE-862apps/OpenSignServer/cloud/parsefunction/getContact.js

2026-05-24

OpenSignLabs/OpenSign

Reflected XSS via userId parameter in delete account HTML page

CWE-79apps/OpenSignServer/cloud/customRoute/deleteAccount/deleteUserGet.js

2026-05-24

tiagozip/cap

CWE-200standalone/src/auth.js

2026-05-24

tiagozip/cap

Static file auth bypass via cookie without cryptographic verification

CWE-863standalone/src/static.js

2026-05-24

EvolutionAPI/evolution-api

Global API key leaked in WebSocket emit messages

CWE-200src/api/integrations/event/websocket/websocket.controller.ts

2026-05-23

EvolutionAPI/evolution-api

API key leaked in webhook payloads to user-controlled URLs

CWE-200src/api/integrations/event/webhook/webhook.controller.ts

2026-05-23

EvolutionAPI/evolution-api

SQL injection via nameInbox in addLabelToContact

CWE-89src/api/integrations/chatbot/chatwoot/services/chatwoot.service.ts

2026-05-23

Snouzy/workout-cool

RevenueCat webhook at /api/webhooks/revenuecat uses timing-unsafe string comparison for auth

CWE-287app/api/webhooks/revenuecat/route.ts

2026-05-23

Snouzy/workout-cool

syncWorkoutSessionAction allows syncing sessions for arbitrary users

CWE-862src/features/workout-session/actions/sync-workout-sessions.action.ts

2026-05-23

hicccc77/WeFlow

Path traversal in media endpoint despite incomplete check

CWE-22electron/services/httpService.ts

2026-05-23

justlovemaki/AIClient2API

Path traversal in static file serving via plugin path

CWE-22src/services/ui-manager.js

2026-05-23

nexmoe/VidBee

SSRF bypass in image proxy via DNS rebinding / TOCTOU

CWE-918apps/api/src/server.ts

2026-05-23

zizifn/edgetunnel

Hardcoded UUID serves as sole authentication, exposed in source code

CWE-200src/worker-vless.js

2026-05-23

zizifn/edgetunnel

SSRF in test worker via unvalidated 'address' query parameter

CWE-918test/worker/cf-cdn-cgi-trace.js

2026-05-23

zizifn/edgetunnel

SSRF in test worker via unvalidated 'target' query parameter

CWE-918test/worker/worker-connect-test.js

2026-05-23

NVIDIA/personaplex

Unsafe tarfile.extractall without path validation (TarSlip)

CWE-23moshi/moshi/server.py

2026-05-22

NVIDIA/personaplex

Unsafe torch.load for model checkpoint files without weights_only

CWE-502moshi/moshi/models/loaders.py

2026-05-22

OpenCTI-Platform/opencti

Stored XSS via Markdown-to-HTML conversion served to authenticated users

CWE-79opencti-platform/opencti-graphql/src/http/httpPlatform.js

2026-05-22

OpenCTI-Platform/opencti

XSS via app:script_snippet config injection into index.html

CWE-79opencti-platform/opencti-graphql/src/http/httpPlatform.js

2026-05-22

hiteshchoudhary/apihub

Arbitrary cookie injection via request body in setCookie

CWE-644src/controllers/kitchen-sink/cookie.controllers.js

2026-05-22

hiteshchoudhary/apihub

User-controlled role assignment during registration

CWE-269src/controllers/apps/auth/user.controllers.js

2026-05-22

mksglu/context-mode

Path traversal in insight server API endpoints via dbHash parameter

CWE-22insight/server.mjs

2026-05-22

viarotel-org/escrcpy

Path traversal bypass in rename-temp-file via string prefix check

CWE-22desktop/electron/services/handles/index.js

2026-05-22

viarotel-org/escrcpy

Arbitrary file open/reveal via open-path and show-item-in-folder IPC handlers

CWE-73desktop/electron/services/handles/index.js

2026-05-22

wechat-article/wechat-article-exporter

XSS via body class attribute injection in normalizeHtml

CWE-79shared/utils/html.ts

2026-05-22

wechat-article/wechat-article-exporter

SSRF via download endpoint fetching user-controlled URLs

CWE-918server/api/public/v1/download.get.ts

2026-05-22

wechat-article/wechat-article-exporter

Client-side code injection via iframe srcdoc with extracted script from untrusted HTML

CWE-94shared/utils/html.ts

2026-05-22

yikart/AiToEarn

Missing authorization on engagement endpoints - public crawler endpoint

CWE-862project/aitoearn-backend/apps/aitoearn-server/src/core/channel/engagement/engagement.controller.ts

2026-05-22

yikart/AiToEarn

Missing ownership check on engagement endpoints

CWE-862project/aitoearn-backend/apps/aitoearn-server/src/core/channel/engagement/engagement.controller.ts

2026-05-22

Wei-Shaw/claude-relay-service

Path traversal in /admin-next/* static file serving

CWE-22src/app.js

2026-05-21

Wei-Shaw/claude-relay-service

SSRF bypass in balance script via DNS rebinding or IPv6 shorthand

CWE-918src/services/balanceScriptService.js

2026-05-21

keephq/keep

CEL validation endpoint and healthcheck endpoint lack authentication

CWE-306keep/api/routes/cel.py

2026-05-21

keephq/keep

Restricted eval on user-influenced enrichment value in _enrich method

CWE-95keep/providers/base/base_provider.py

2026-05-21

mailcow/mailcow-dockerized

Path traversal in df command via request_json['dir']

CWE-78data/Dockerfiles/dockerapi/modules/DockerApi.py

2026-05-21

open-metadata/OpenMetadata

Environment variable injection via os.path.expandvars in config file loading

CWE-78ingestion/src/metadata/config/common.py

2026-05-21

rowboatlabs/rowboat

Path traversal in file download endpoint via database-stored path

CWE-22apps/rowboat/app/api/uploads/[fileId]/route.ts

2026-05-21

seerr-team/seerr

SQL LIKE injection via unsanitized user search query

CWE-89server/routes/user/index.ts

2026-05-21

seerr-team/seerr

SQL LIKE injection via unsanitized blocklist search query

CWE-89server/routes/blocklist.ts

2026-05-21

simular-ai/Agent-S

Shell injection via LLM-generated code in show_permission_dialog

CWE-78gui_agents/s1/cli_app.py

2026-05-21

thedevs-network/kutt

SQL injection via ILIKE with unsanitized search/user params in admin queries

CWE-89server/queries/domain.queries.js

2026-05-21

thedevs-network/kutt

HTML injection via sendReportEmail rendering link as HTML

CWE-79server/mail/mail.js

2026-05-21

wanglin2/mind-map

XSS via unsanitized SVG title elements in hyperlink and attachment nodes

CWE-79simple-mind-map/src/core/render/node/nodeCreateContents.js

2026-05-21

wanglin2/mind-map

DOM-based XSS via innerHTML assignments with untrusted HTML content

CWE-79simple-mind-map/src/utils/index.js

2026-05-21

wanglin2/mind-map

XSS via SVG title injection in export SVG

CWE-79simple-mind-map/src/plugins/Export.js

2026-05-21

EveryInc/compound-engineering-plugin

Shell injection via Python string interpolation in add_blocker()

CWE-78plugins/compound-engineering/skills/ce-optimize/scripts/parallel-probe.sh

2026-05-20