[MEDIUM] Craft CMS: Stored XSS in the control panel via unescaped draft name

PKSA-x767-zzvx-956t GHSA-2rp4-x2j7-qmcc

Affected version: >=5.0.0-RC1,<5.10.8

Reported by:
GitHub

[HIGH] Craft CMS: Arbitrary user password reset leading to administrator account takeover

PKSA-s5dz-k87m-97ms GHSA-p8x7-9vfw-p7vc

Affected version: >=5.0.0-RC1,<5.10.8

Reported by:
GitHub