mayswind ezBookkeeping

• CVE-2026-86041 Medium 5.3 ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header 0.2%
• CVE-2026-105131 Medium 5.4 mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint 0.2%
• CVE-2026-94112 Medium 6.8 mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack 0.4%