roadiz core-bundle-dev-app

• CVE-2026-42206 Medium 5.7 Roadiz OpenID Connect nonce generated but never validated — ID token replay attack 0.2%
• CVE-2026-33486 Medium 6.8 Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents 0.4%