A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input…

A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials

Stored Cross-Site Scripting

During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control