CVE-2026-30633

Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the getdoc and updatedoc tools...

PT-2026-63315

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Three code paths bypass the existing Server-Side Request Forgery SSRF protections by using raw http.Get instead of the validated hostmatcher.NewDialContext dialer. This allows an attacker to ma...

CVE-2026-30633

The software knowns-dev/knowns version 0.11.4 contains a directory traversal vulnerability. The flaw is triggered by providing a crafted path value to the get_doc and update_doc tools. This vulnerability allows for an improper limitation of a pathname to a restricted directory. No specific remedi...

CVE-2026-30633

Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the getdoc and updatedoc tools...

PT-2026-61961

A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulation of the argument X-Tenant-Id leads to authorization...

CVE-2026-65319: Missing Authentication for Critical Function

Feedbin commit 739884a contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterat...

PT-2026-63311

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains an information disclosure issue where requests containing the go-get query parameter with a value of 1 bypass authentication and authorization checks. This behavior is triggered ...

CVE-2026-50759

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...

CVE-2026-64821: Cross-Site Request Forgery (CSRF)

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

The vulnerability of the Get() function in the ZenLib::BitStream_LE::Get() function from the file ZenLib/Source/ZenLib/BitStream_LE.h, a data reading library, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ZenLib::BitStreamLE::Get function in the ZenLib/Source/ZenLib/BitStreamLE.h header file of the MediaInfo reading library is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

The vulnerability of the Get() function in the ZenLib::BitStream_LE::Get() function from the file ZenLib/Source/ZenLib/BitStream_LE.h, a data reading library, allows a malicious actor to cause a service failure.

The vulnerability of the ZenLib::BitStreamLE::Get function in the ZenLib/Source/ZenLib/BitStreamLE.h header file of the MediaInfo reading library is related to dependencies that are undefined for each implementation type. Exploiting this vulnerability could allow an attacker to cause a service...

CVE-2026-50759: Missing Authentication for Critical Function

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution n the getMergedValue function of lib/core/mergeConfig.js, which clones nested option objects such as auth and paramsSerializer into...

Axios: Prototype pollution gadgets can alter axios request construction

Summary axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get, axios.delete, axios.head, and axios.options read inherited da...

CVE-2026-53592 FreeScout vulnerable to prototype pollution in getQueryParam

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the getQueryParam function /public/js/main.js and was addressed in version 1.8.139 by blocking URL query keys matching the pattern proto. However, this mitigation is incomplete: i...

CVE-2026-63107

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

CVE-2026-32823

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

EUVD-2026-45997

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

CVE-2026-32823 dataCycle State-Changing GET Endpoints Enable CSRF

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

CVE-2026-32823 dataCycle State-Changing GET Endpoints Enable CSRF

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...