CVE-2026-70561

TestLink 1.9.20 and earlier is affected by an insecure direct object reference in the attachmentdownload.php endpoint. An authenticated user, including low-privilege guests, can read arbitrary attachments by supplying any integer attachment ID, bypassing per-project access checks. Attackers can e...

EUVD-2026-54573

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

CVE-2026-19229

A vulnerability was determined in SourceCodester Online Clothing Store. Affected by this issue is some unknown functionality of the file /notes/ of the component Dreamweaver Metadata Files. Executing a manipulation can lead to file and directory information exposure. The attack can be launched...

CVE-2026-19082

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

CVE-2026-44965

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-44964

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

EUVD-2026-54564

A vulnerability was determined in SourceCodester Online Clothing Store. Affected by this issue is some unknown functionality of the file /notes/ of the component Dreamweaver Metadata Files. Executing a manipulation can lead to file and directory information exposure. The attack can be launched...

CVE-2026-19229 SourceCodester Online Clothing Store Dreamweaver Metadata Files _notes file information disclosure

A vulnerability was determined in SourceCodester Online Clothing Store. Affected by this issue is some unknown functionality of the file /notes/ of the component Dreamweaver Metadata Files. Executing a manipulation can lead to file and directory information exposure. The attack can be launched...

EUVD-2026-54561

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

CVE-2026-19082

Affected product: Imager (Perl) versions from 0.45_02 up to (but not including) 1.034. Root cause: copy_string_tags computes tag length as entry->size - 1; when entry->size is 0 (zero-count ASCII EXIF entry), i_tags_add() uses -1, causing strlen() to read past the entry and copy adjacent he...

CVE-2026-19082 Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

CVE-2026-19082

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettings is enabled. An attacker can obtain the absolute project...

Information Exposure

Overview org.webjars.npm:nuxt is a Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettings is enabled. An attacker can...

Information Exposure

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettin...

CVE-2026-17595 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

CVE-2026-17595

Nexus Repository 3 is affected by a JEXL Content Selector sandbox bypass where an account with nexus:selectors:create could read Java object properties not intended for exposure, potentially revealing internal JVM class metadata (e.g., class and classloader names). The issue stems from incomplete...

CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...