papra-hq papra

• CVE-2026-48052 Medium 5.4 Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request 0.4%
• CVE-2026-48051 Low 3.5 Papra: SSRF via HTTP redirect bypass in webhook delivery 0.3%
• CVE-2026-35462 Medium 4.3 Papra Does Not Reject Expired API Keys 0.2%
• CVE-2026-35461 Medium 5.0 Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL 0.2%
• CVE-2026-35460 Medium 4.3 Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name 0.2%