PT-2026-64376

Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12 Description A missing object-level authorization issue exists in the JSON-RPC API. This allows holders of API tokens to enumerate account metadata, overwrite passwords, and delete accounts across the entire...

EUVD-2026-48427

Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1...

CVE-2026-65713

Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories...

CVE-2026-65713 Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension

Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories...

CVE-2026-65713 Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension

Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories...

EUVD-2026-47898

Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories...

CVE-2026-65713

CVE-2026-65713 concerns the Joomla Extension from regularlabs.com, specifically the Modals Pro extension. The issue is insecure path handling in the Modals gallery paths, which could allow enumeration of unintended directories. The available data lists a CVSS v3.1 base score of 6.5 (Medium) with ...

GHSA-7X2P-4JVH-6384 Dompdf: File existence oracle via font-face stylesheet declaration

Description Dompdf is vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. The critical point of this flaw ...

Dompdf: File existence oracle via font-face stylesheet declaration

Description Dompdf is vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. The critical point of this flaw ...

CVE-2026-65012

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...

EUVD-2026-47744

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...

CVE-2026-65012

CVE-2026-65012 affects InvokeAI prior to 6.13.7. An unauthenticated vulnerability in GET /api/v2/models/scan_folder allows attacker-controlled scan_path to recursively enumerate arbitrary server filesystem directories, revealing existence/readability via HTTP response codes and bypassing multi-us...

CVE-2026-65012 InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...

CVE-2026-65012 InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...

CVE-2026-65012 InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...

USN-8586-1 libgphoto2 vulnerabilities

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS image format data. An attacker with physical access could possibly use this issue to obtain sensitive information. CVE-2026-40333 It was discovered that libgphoto2 did not properly null-terminate buffer...

EUVD-2026-47563

Feedbin commit 739884a contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterat...

CVE-2026-65319

Feedbin commit 739884a contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterat...

CVE-2026-65319

Feedbin contains an unauthenticated information disclosure via the GET /api/v2/entries/:id/text endpoint. The vulnerability arises because the authorization check is bypassed (before-action filter skipped), enabling an attacker to enumerate private article content by iterating sequential entry ID...

CVE-2026-65319 Feedbin Unauthenticated Entry Content Disclosure via GET /api/v2/entries/:id/text

Feedbin commit 739884a contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterat...