CVE-2026-30957

CVE-2026-30957 / GHSA-JW8Q-GJVG-8W4Q describes a server-side remote code execution in OneUptime’s Synthetic Monitors. The root cause is that untrusted Synthetic Monitor code runs inside Node VM with live Playwright browser/page objects injected into the VM context. Although VMRunner proxies host ...

CVE-2025-64516

GLPI before versions 10.0.21 and 11.0.3 suffers an access-control vulnerability where an unauthorized user can view documents attached to any item (tickets, assets, etc.). If the public FAQ is enabled, this can be exploited anonymously. The issue is fixed in GLPI 10.0.21 and 11.0.3. CVSS v3.1 sco...

CVE-2025-64520 GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch...