Please don't open a public issue for security problems. Use the repository's Security tab → Report a vulnerability. You'll get a reply within a few days, and credit in the changelog once it's fixed.

Especially interesting: forged or reused join tokens, a viewer or participant getting host powers, LTI launch checks that can be skipped, webhook signature bypasses, and reaching internal addresses through webhooks.