Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettings is enabled. An attacker can obtain the absolute project...

Information Exposure

Overview org.webjars.npm:nuxt is a Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettings is enabled. An attacker can...

Information Exposure

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettin...

CVE-2026-17595 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

CVE-2026-17595

Nexus Repository 3 is affected by a JEXL Content Selector sandbox bypass where an account with nexus:selectors:create could read Java object properties not intended for exposure, potentially revealing internal JVM class metadata (e.g., class and classloader names). The issue stems from incomplete...

CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

EUVD-2026-54488

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

JLSEC-2026-1189 FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read...

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...

MAL-2026-13522 Malicious code in base-ui-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd7a855915fc307b9d0c8feee91b135ea2724c300205df6fd3dcb32833ee95b dist/index.js issues fetch calls to https://base-ui-pro-registry.l-dimitrov.workers.dev in addition to https://registry.npmjs.org. The Cloudflare...

CVE-2026-66838 SQL injection via the :comment option in Postgrex.stream/4

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by multiple vulnerabilities due to Eclipse Jetty

Summary Eclipse Jetty is used by IBM Cloud Pak for Data System 1x to provide web application server functionality. CVE-2026-10051 affects Jetty's HTTP/1.1 request handling when trailers are retained across multiple requests on the same connection, potentially exposing sensitive information from...

CVE-2026-54206

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54204

Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled...

CVE-2026-54201

Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid through...

CVE-2026-38053

creationtimestamp| type| source ---|---|--- 2026-08-07 10:12:54+00:00| published-proof-of-concept| Telegram/cr6l50opWOBaeLyWntUIu5BxD85N7mmykPrPwEONJj0b8 2026-08-08 00:17:13+00:00| published-proof-of-concept| Telegram/cr6l50opWOBaeLyWntUIu5BxD85N7mmykPrPwEONJj0b8...

EUVD-2026-54450

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54205

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54205 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionality

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54205

The vulnerability CVE-2026-54205 affects Tobit Laboratories AG TeamDavid’s Webbox link-storing functionality. The server-side code accepts a pathname parameter that can be a UNC network location (e.g., \Server\Share) without validation, causing outbound connections to attacker-controlled SMB endp...

CVE-2026-54213 TeamDavid: Denial of Service via endpoint 'internalRestart'

Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint /internalRestart is accessed. This endpoint is accessible to unauthenticated users over the public Internet. Instead of “restarting”, the server shuts...