Morelitea initiative

• CVE-2026-28276 High 7.5 Initiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ Endpoint 0.4%
• CVE-2026-28275 High 8.1 Initiative Vulnerable to Improper Session Invalidation (JWT Remains Valid) 0.4%
• CVE-2026-28274 High 8.7 Initiative Vulnerable to Token Theft via Stored XSS in Document Uploads 0.6%