Cross-site Scripting (XSS) – Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.

Improper Access Control in Pypi calibreweb prior to 0.6.16.

Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.

The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting

Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.

Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0.