Added

• After 5 login attempts, Kavita will impose a 10 min lockout before authentication can be retried

Fixed

• Fixed an exploit that allowed a user to change the admin user's account password, thus taking ownership of the server
• Fixed an exploit that would allow an unauthorized user to delete reading list items within a user's reading list 
• Fixed an exploit that allowed a user to abuse an API and leak sensitive files from the system
• Fixed an exploit that allowed an unauthenticated user to download pdfs from the server
• Fixed an exploit (SSRF) that would allow a user to upload a cover image that isn't an image