CVE-2026-100682

Budibase Server versions prior to 3.45.0 are vulnerable to an arbitrary file write vulnerability within the PWA icon upload endpoint . The root cause is a lack of proper symlink validation during the extraction of user-supplied ZIP archives. An attacker with the BUILDER role can exploit this by c...

CVE-2026-100682 Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entri...

CVE-2026-100682 Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entri...

CVE-2026-100682 Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entri...

CVE-2026-100625 Capgo Build Upload Proxy Authorization Bypass via TUS Resource

Capgo capgo.app exposes a native build TUS upload proxy supabase/functions/backend/public/build/upload.ts that authorizes a caller against a single build job identified by the supplied builderjobid and validates only that job's stored uploadpath, but then forwards the user-controlled TUS resource...

EUVD-2026-87720

Capgo capgo.app exposes a native build TUS upload proxy supabase/functions/backend/public/build/upload.ts that authorizes a caller against a single build job identified by the supplied builderjobid and validates only that job's stored uploadpath, but then forwards the user-controlled TUS resource...

CVE-2026-100625

The Capgo (capgo.app) platform is vulnerable to an authorization bypass in its native build TUS upload proxy located at supabase/functions/_backend/public/build/upload.ts. The root cause is that the proxy validates a caller against a specific builder_job_id but fails to bind the forwarded user-co...

CVE-2026-100624 Capgo.app before 12.264.5 Upload Expiry Bypass via build upload

Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...

CVE-2026-100624 Capgo.app before 12.264.5 Upload Expiry Bypass via build upload

Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...

EUVD-2026-87719

Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...

CVE-2026-100624

Capgo.app versions prior to 12.264.5 are vulnerable to an upload expiry bypass in the /build/upload/:jobId TUS proxy endpoint. The root cause is that the upload proxy fails to enforce the upload_expires_at timestamp or the pending status from the build_requests table; it only verifies the app.bui...

CVE-2026-100624 Capgo.app before 12.264.5 Upload Expiry Bypass via build upload

Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...

Exploit for CVE-2026-13249

CVE-2026-13249 — Honeywell PD45 Unauthenticated File Upload R...

Exploit for CVE-2026-18143

CVE-2026-18143 — Request a Quote for WooCommerce Addify Arbi...

CVE-2026-18143

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw...

CVE-2026-18143

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 2.9.2 . The issue resides in the afrfq_submit_quote_via_popup() function, where the popup upload handler fails to perform file extension and MIME type validation . C...

EUVD-2026-87542

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw...

CVE-2026-18143 Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw...

CVE-2026-18143 Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw...

Missing Authorization

Overview @openclaw/discord is an OpenClaw Discord channel plugin Affected versions of this package are vulnerable to Missing Authorization via the emoji and sticker upload actions, which drop the sender-scoped media policy before loading a local file. A sender permitted to invoke those actions ca...