Search results

Notion OAuth callback hardcoded to localhost — open redirect to attacker-controlled local server

Status: Open.

#4 In codextde/vectorbase-ai-knowledgebase;

· noobx123 opened on Jun 14, 2026

Website crawler SSRF — Playwright fetches internal URLs with no IP allowlist

Status: Open.

#3 In codextde/vectorbase-ai-knowledgebase;

· noobx123 opened on Jun 14, 2026

Caller-controlled model and max_tokens enables unlimited OpenAI cost abuse

Status: Open.

#2 In codextde/vectorbase-ai-knowledgebase;

· noobx123 opened on Jun 14, 2026

Unauthenticated cron endpoints trigger cross-tenant source reprocessing

Status: Open.

#1 In codextde/vectorbase-ai-knowledgebase;

· noobx123 opened on Jun 14, 2026