When you visit the URL: https://bugs.kali.org/login_page.php, while not logged in.
The page will give a warning:

Warning: "path" was not defined in config_inc.php. Leaving it empty is a security risk, as the path will be set based on headers from the HTTP request, exposing your system to Host Header Injection attacks.

Seems to be easily fixable: https://forum.yunohost.org/t/warning-path-was-not-defined-in-config-inc-php/37573