cross-site scripting in wetty (CVE-2026-49864). Risk of unauthorized operations or information disclosure. Exploitable via ``cat``. Mitigation: upgrade to `3.0.4` or later.
path traversal in easycorp/easyadmin-bundle (GHSA-2wwr-9x6f-88gp). Risk of unauthorized operations or information disclosure. Exploitable via ``countryCode``. Mitigation: upgrade to `5.0.10` or later.
SSRF in auth-fetch-mcp (CVE-2026-49857). Confidential information can be exposed externally. Exploitable via ``false``. Mitigation: upgrade to `3.0.2` or later.