Roadiz Core-bundle-dev-app vulnerabilities

• roadiz core-bundle-dev-app Roadiz OpenID Connect nonce generated but never validated — ID token replay attack CVE-2026-42206 Fix available 5.7 MediumApril 29, 2026
• roadiz core-bundle-dev-app Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents CVE-2026-33486 Fix available 6.8 MediumMarch 23, 2026