Nanhang

**Name of the Vulnerable Software and Affected Versions** OpenAkita versions prior to 1.27.13 **Description** A flaw in the File Upload API component allows remote attackers to perform cross-site scripting (XSS), which is a technique used to inject malicious scripts into web pages viewed by other users. The issue exists within the `/api/upload` endpoint and is triggered by the manipulation of the `File` argument. This attack is characterized by high complexity and difficult exploitability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `/api/upload` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Neovim versions prior to 0.12.3 **Description** A flaw in the View Branch component allows for command injection via the local host. The issue exists within the `M.read()` function located in the `runtime/lua/vim/secure.lua` file, where manipulating the `path` argument can lead to arbitrary command execution. **Recommendations** Apply patch f83e0dcaf8cf18de94828341b0a1a61a86c75baf to remediate the issue. As a temporary workaround, restrict or avoid the use of the `M.read()` function in `runtime/lua/vim/secure.lua` when handling untrusted `path` arguments.