CVE-2026-39372 InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through invoice attachments, quote attachments, or...

CVE-2026-39372 InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through invoice attachments, quote attachments, or...

CVE-2026-39372 InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through invoice attachments, quote attachments, or...

BIT-POSTGIS-2026-73515 PostGIS < 3.7.0 Out-of-Bounds Read via FlatGeobuf Buffer

PostGIS before 3.7.0 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the...

CVE-2026-93030

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

CVE-2026-93030

The FTM 4.x ALL software is vulnerable to an XML external entity injection flaw. This security weakness could allow a remote authenticated attacker to obtain sensitive information . No specific exploitation details or remediation steps are provided in the documents.

CVE-2026-93030

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw...

CVE-2026-93030

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw...

CVE-2026-51773

A flaw was found in the VMware datastore driver of OpenStack glancestore. When an authenticated user supplies a crafted image location Uniform Resource Identifier URI pointing to an external host, the driver fails to validate the destination before forwarding requests. An attacker can exploit thi...

CVE-2026-85029

IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitation of a pathname to a restricted directory...

UBUNTU-CVE-2026-100070

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnatsip: rewind offset when NAT shrinks the packet sashiko says: If mapaddr changes the packet length, such as when the public NAT IP string is shorter or longer than the internal IP, coff will still point to the offs...

CVE-2026-84893

IBM Guardium Data Protection 12.2 is vulnerable to an SQL injection flaw located in the PESI service . This vulnerability allows an authenticated attacker to exploit the service to gain unauthorized access to sensitive information stored within the internal database. No specific exploit details o...

CVE-2026-85029

IBM Guardium Data Protection 12.2 is vulnerable to a path traversal vulnerability (CWE-22 ) due to improper limitation of a pathname to a restricted directory. A remote attacker could exploit this to obtain sensitive information, delete arbitrary files, or execute arbitrary code. IBM encourages c...

CVE-2026-85029 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitation of a pathname to a restricted directory...

EUVD-2026-87100

IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitation of a pathname to a restricted directory...

CVE-2026-85029 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitation of a pathname to a restricted directory...

DEBIAN-CVE-2026-51773

An issue in the VMware datastore driver of OpenStack glancestore. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the retryrequest function fails to validate the destination host before attaching sensitive authentication headers...

CVE-2026-52622

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function...

CVE-2026-51773

An issue in the VMware datastore driver of OpenStack glancestore. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the retryrequest function fails to validate the destination host before attaching sensitive authentication headers...