freedomofpress securedrop-client

• CVE-2026-49996 Low 3.7 securedrop-proxy origin limitation can be bypassed with redirects 0.3%
• CVE-2026-35465 High 7.5 SecureDrop Client has path injection in read_gzip_header_filename() 0.4%
• CVE-2025-24889 Medium 4.5 Path traversal in sd-log Qubes virtual machine 0.2%
• CVE-2025-24888 High 8.1 Path traversal in SecureDrop Client API.download_reply() 1.0%