Search results

推荐给这个，实际上rule 没有配置，无法投递

Status: Open.

#264 In coco-xyz/clawmark;

· kevinho opened on Mar 9, 2026

移除 coco-xyz/clawmark 这个 fallback

Status: Open.

#253 In coco-xyz/clawmark;

· kevinho opened on Mar 9, 2026

Dashboard: javascript: URL XSS + credential exposure in auth table + double-fetch race

Status: Open.

#252 In coco-xyz/clawmark;

· BoyClaw opened on Mar 7, 2026

Unauthenticated /api/v2/adapters endpoint + endpoint configs stored in plaintext

Status: Open.

#251 In coco-xyz/clawmark;

· BoyClaw opened on Mar 7, 2026

Race condition in discussion file operations (concurrent write data loss)

Status: Open.

#250 In coco-xyz/clawmark;

· BoyClaw opened on Mar 7, 2026

Missing .dockerignore — secrets and .git copied into Docker image

Status: Open.

#249 In coco-xyz/clawmark;

· BoyClaw opened on Mar 7, 2026

Dispatch log endpoints leak data for deleted items (missing null check)

Status: Open.

#248 In coco-xyz/clawmark;

· BoyClaw opened on Mar 7, 2026

Stored XSS via markdown image src in widget fab plugin

Status: Open.

#247 In coco-xyz/clawmark;

· BoyClaw opened on Mar 7, 2026

Auth token leaked to any localhost page via externally_connectable

Status: Open.

#246 In coco-xyz/clawmark;

· BoyClaw opened on Mar 7, 2026

Multiple XSS vulnerabilities in side panel via unescaped server data

Status: Open.

#245 In coco-xyz/clawmark;

· BoyClaw opened on Mar 7, 2026

V1 API endpoints missing app_id scope check (broken access control)

Status: Open.

#244 In coco-xyz/clawmark;

· BoyClaw opened on Mar 7, 2026

SQL Injection in getItemsByTag via LIKE pattern

Status: Open.

#243 In coco-xyz/clawmark;

· BoyClaw opened on Mar 7, 2026