232 matches found
CVE-2026-84637
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This...
CVE-2026-84637: Unrestricted Upload of File with Dangerous Type
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This...
PT-2026-84524
Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.2 Thunderbird versions prior to 154 Description Malicious calendar invitations can utilize file URI attachments to execute local or network-hosted executables on Windows systems, bypassing standard executable...
CVE-2026-52872
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...
CVE-2026-52877
In Streambert versions before 2.6.0, the open-external IPC handler in src/ipc/downloads.js forwards renderer-supplied URLs to Electron's shell.openExternal without protocol validation. A compromised renderer can inject file: URIs or custom schemes, leading to local file access, remote resource re...
CVE-2026-52877 Streambert : Insecure Protocol Execution in open-external IPC Handler
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer...
CVE-2026-52877 Streambert : Insecure Protocol Execution in open-external IPC Handler
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer...
CVE-2026-52872 Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...
EUVD-2026-62195
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...
CVE-2026-52877: Improper Input Validation
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer...
SUSE CVE-2026-55404
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpageurl or filename metadata without sufficient validation or escaping,...
CVE-2026-58420
Local File Inclusion via file:// URI in Migration Restore...
CVE-2026-58420
Local File Inclusion via file:// URI in Migration Restore...
CVE-2026-58420 Local File Inclusion via file:// URI in Migration Restore
Local File Inclusion via file:// URI in Migration Restore...
EUVD-2026-58153
Local File Inclusion via file:// URI in Migration Restore...
CVE-2026-58420 Local File Inclusion via file:// URI in Migration Restore
Local File Inclusion via file:// URI in Migration Restore...
CVE-2026-58420: Improper Access Control
Local File Inclusion via file:// URI in Migration Restore...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...