dylanjkotze Zephyr Project Manager

• CVE-2026-120514 Medium 5.4 Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter –
• CVE-2026-76931 Medium 6.4 Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter 0.3%
• CVE-2025-12496 Medium 4.9 Zephyr Project Manager <= 3.3.203 - Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery 0.7%
• CVE-2025-10490 Medium 4.4 Zephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site Scripting 0.2%
• CVE-2024-7624 High 8.1 Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation 0.4%
• CVE-2024-7356 Medium 6.4 Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter 0.3%
• CVE-2022-1822 Medium 6.1 Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting 1.1%