CVE-2026-71234

Documize Community exposes an authentication bypass in the attachment download endpoint: the Download function accepts a non-empty secure query parameter and grants access without validating against a server-stored value. This is inconsistent with sibling handlers (togglePublish, delete) which en...

CVE-2026-71234: Incorrect Authorization

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stored valu...

ROOT-APP-NPM-CVE-2026-27795 CVE-2026-27795 in @langchain/community - Patched by Root

Root has patched CVE-2026-27795 in the @langchain/community package for Root:npm. Multiple fixed versions available...

CLSA-2026-1778114660 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.6.9-tuxcare.1...

CLSA-2026-1777941835 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 11.4.1-tuxcare.1...

CLSA-2026-1778114659 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.7-tuxcare.1...

CLSA-2026-1778114661 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 14 @react-native-community packages to address 1 CVE. Fixed in 15.1.3-tuxcare.1...

CVE-2026-3093 vulnerabilities

Vulnerabilities for packages: gitlab-cng, gitlab-cng-fips, gitlab-runner, gitlab-workhorse-ce-fips, gitlab-rails-ce-fips, gitlab-workhorse-ce, gitlab-runner-fips, gitlab-rails-ce...

CVE-2026-14351 vulnerabilities

Vulnerabilities for packages: gitlab-cng, gitlab-cng-fips, gitlab-runner, gitlab-workhorse-ce-fips, gitlab-rails-ce-fips, gitlab-workhorse-ce, gitlab-runner-fips, gitlab-rails-ce...

CVE-2026-65875

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed...

CVE-2026-65875

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed...

PT-2026-67263

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed...

Exploit for CVE-2025-48932

CVE-2025-48932-Invision-Community-SQLi-Exploit CVE-2025-48932...

OESA-2026-3230 haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Security Fixes: HAProxy Community...

EUVD-2026-51330

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

CVE-2026-64816

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

CVE-2026-64816 RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

CVE-2026-64816

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

CVE-2026-64816

RapidRAW before 1.6.0 fails to validate lutPath in preset files before File::open() in lut_processing.rs. On Windows, a UNC path in lutPath can trigger an outbound SMB connection to an attacker-controlled host, leaking NTLMv2 credentials. The vulnerability is reachable via two vectors: (1) commun...

CVE-2026-64816 RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...