MINI-XV88-VQ3P-XCXW

Bulletin has no description...

MINI-2W9X-549J-M563

Bulletin has no description...

MINI-FG8P-QGHP-FVJW

Bulletin has no description...

MINI-2H2G-6F3H-PM9H

Bulletin has no description...

MINI-5XGG-CXMW-FCP6

Bulletin has no description...

MINI-PVV9-M349-HW9R

Bulletin has no description...

MINI-69WH-C2P2-4G76

Bulletin has no description...

MINI-7MX5-FR6H-X2VQ

Bulletin has no description...

MINI-R66R-8XXF-HWJV

Bulletin has no description...

MINI-56X8-F354-37F4

Bulletin has no description...

MINI-6W92-M35J-W97P

Bulletin has no description...

MINI-JV8C-VQJQ-CF9C

Bulletin has no description...

MINI-VRFC-6H9H-374J

Bulletin has no description...

MINI-MFW8-RMW4-5X6M

Bulletin has no description...

MINI-4726-4H97-RRJX

Bulletin has no description...

CVE-2026-62945

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...

CVE-2026-72843

EverShop 's updateCustomer route (packages/evershop/src/modules/customer/api/updateCustomer/route.json) is declared "access": "public", so the admin auth middleware calls next() without verifying the caller and no session guard protects the route. The handler in updateCustomer.js loads a customer...

CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

CVE-2026-49245

SFTPGo (open-source file transfer solution) versions 2.2.0 through 2.7.3 are affected by a stored XSS vulnerability. The inline query parameter on browsable-share and authenticated user-file download endpoints suppressed Content-Disposition: attachment, allowing an attacker-placed HTML file in a ...

EUVD-2026-63704

TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList and importNaverList in server/src/services/placeService.ts and resolveGoogleMapsUrl in server/src/services/mapsService.ts. The affected sinks call...