CVE-2026-82906 sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-82906

A missing authentication flaw in sdcb chats versions up to 1.12.0 affects the Signed File Download Endpoint , specifically the DownloadPublic function in src/BE/web/Controllers/Chats/Files/FileController.cs. An unauthenticated remote attacker with high complexity can exploit this to achieve low c...

CVE-2026-82906 sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possibl...

MAL-2026-15631 Malicious code in nextjsupdater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca The package masquerades as a Next.js updater but its exported downloadAndRunUpdate function fetches updater.hta from an unrelated personal GitHub...

CVE-2026-51671

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Exploit for CVE-2026-76569

Reflected XSS via search GET Parameter in Phoca Download Ph...

PT-2026-83813

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83983

Name of the Vulnerable Software and Affected Versions sdcb chats versions prior to 1.12.1 Description A flaw in the Signed File Download Endpoint component allows remote exploitation due to missing authentication. The issue resides in the DownloadPublic function within the...

CVE-2026-82906: Missing Authentication for Critical Function

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-51671: Improper Access Control

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-82656

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

CVE-2026-82656 Admidio before 5.0.12 Path Traversal via Photo ZIP Download

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

CVE-2026-82656 Admidio before 5.0.12 Path Traversal via Photo ZIP Download

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

CVE-2026-82656 Admidio before 5.0.12 Path Traversal via Photo ZIP Download

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

CVE-2026-82656

Admidio versions before 5.0.12 contain a path traversal vulnerability in the photo ZIP download functionality. Authenticated users with album-creation rights can craft malicious album names containing directory traversal sequences. When recipients extract the resulting archive, the unsanitized en...

EUVD-2026-68242

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

CVE-2026-82656: Improper Limitation of a Pathname to a Restricted Directory

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

PT-2026-83555

Name of the Vulnerable Software and Affected Versions Pake versions prior to 3.13.1 Description The download file Tauri command fails to sanitize the JavaScript-supplied filename before joining it to the user's Downloads directory. This allows a filename containing an absolute path or path...

PT-2026-83582

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

MAL-2026-15564 Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...