Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass
No next occurrence is being forecast right now — this pattern has gone quiet and needs to keep recurring before we forecast it again.
Why: it has occurred on 5 days (71% of the days we've watched), usually around 18:49 UTC.
Defaxon forecasts when a recurring event is likely to happen again — its rhythm — not the outcome. For a sports fixture that means we flag that the match recurs, not who wins; for a flight, that the route runs, not whether it’s on time. It’s probabilistic early-warning, never prophecy, and it sharpens as the archive grows.
How accurate have we been?
We’re still building its track record — no forecast has come due yet. Watch the dates below resolve to ✓ or ✗ over time.
The events behind it
Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass
Gitea: Token scope bypass on web archive download endpoint
Gitea: Missing repository-unit authorization on issue-template API endpoints
Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw
Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication
Gogs: Overwriting critical files results in a denial of service
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-202…
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and R…
Cross-site scripting via <NoScript> slot content in Nuxt's head components
LiteLLM: Authentication Bypass via Host Header Injection
Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens
n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
n8n: Credential Exfiltration via Permission Bypass
n8n: Denial of Service via ZIP decompression in webhook workflow
n8n: Public API Execution Retry Authorization Bypass
n8n: Python Code Node AST Validator Bypass
n8n: Stored XSS in Chat Trigger Node