CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

EUVD-2026-70484

Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal...

Defcon-Dreamcast-Planetweb-Research

PlanetWeb Dreamcast Browser v3.0 — Eden service-subscription R...

PT-2026-85135

Name of the Vulnerable Software and Affected Versions OpenList versions prior to 4.2.3 Description The offline-download feature at the 'POST /api/fs/add offline download' endpoint is susceptible to path traversal when using the tool: "SimpleHttp" configuration. The application accepts a...

CVE-2026-75602: Improper Limitation of a Pathname to a Restricted Directory

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

Linux Distros Unpatched Vulnerability : CVE-2026-84366

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler...

CVE-2026-55421 Open edX Platform: SSRF in Studio Video Download Endpoint

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-55421 Open edX Platform: SSRF in Studio Video Download Endpoint

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-55421

Open edX Platform is vulnerable to SSRF with response exfiltration in the Studio Video Download Endpoint. Prior to commit 00b7c3c, the endpoint accepts a user-supplied files[].url and performs a server-side fetch via requests.get(url, allow_redirects=True), returning the fetched bytes inside a ZI...

CVE-2026-55421 Open edX Platform: SSRF in Studio Video Download Endpoint

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-84677

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values plugin names, descriptions, and version metadata on plugin download index pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to provide a plugin for hosting...

CVE-2026-84677

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values plugin names, descriptions, and version metadata on plugin download index pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to provide a plugin for hosting...

CVE-2026-84677

The Jenkins update-center2 tool (version 3.18.3 and earlier ) contains a stored cross-site scripting (XSS) vulnerability. The root cause is the failure to escape plugin-provided values, specifically plugin names, descriptions, and version metadata , when rendering plugin download index pages. Thi...

EUVD-2026-70150

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values plugin names, descriptions, and version metadata on plugin download index pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to provide a plugin for hosting...

CVE-2026-84677

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values plugin names, descriptions, and version metadata on plugin download index pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to provide a plugin for hosting...

Cross-site Scripting (XSS)

Overview sulu/sulu is a highly extensible open-source PHP content management system based on the Symfony framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the download process. An attacker can execute arbitrary JavaScript in the context of the application...

EUVD-2026-68891

Sulu: Stored XSS via media download inline-disposition override...

GHSA-PP4X-CCXQ-6R33 Sulu: Stored XSS via media download inline-disposition override

Impact Stored Cross Site Scripting XSS in the media download endpoint. The download route /media/id/download/slug and its admin variant accepts the query parameter ?inline=1. When it is present, the response is sent with the header Content-Disposition: inline for any MIME type, which overrides th...

Sulu: Stored XSS via media download inline-disposition override

Impact Stored Cross Site Scripting XSS in the media download endpoint. The download route /media/id/download/slug and its admin variant accepts the query parameter ?inline=1. When it is present, the response is sent with the header Content-Disposition: inline for any MIME type, which overrides th...

CVE-2026-14982

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...