CVE-2026-101056

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a contexthint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zer...

CVE-2026-101056 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a contexthint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zer...

CVE-2026-101056 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a contexthint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zer...

CVE-2026-101056

Cloudreve versions prior to 4.16.1 are vulnerable to an authentication bypass caused by a failure to revalidate share access when restoring cached navigator state from a context_hint UUID . An attacker who previously held valid share access can replay the cached hint to generate signed file URLs ...

CVE-2026-101056 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a contexthint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zer...

EUVD-2026-87981

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a contexthint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zer...

CVE-2026-101056: Incorrect Authorization

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a contexthint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zer...

CVE-2026-84025

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...

CVE-2026-84025

The BEAR (Bulk Editor and Products Manager Professional for WooCommerce) WordPress plugin versions before 1.2.2 is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to perform sufficient ownership checks on several handlers that return product data based on a user-suppli...

PT-2026-90576

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...

CVE-2026-53580

Trilium is an open-source hierarchical note-taking application affected in versions prior to 0.104.0 . The automatic image-download feature accepts file:// URLs in tags within text notes and performs a filesystem read with no path validation . Because the HTML sanitizer allows the file scheme, a...

CVE-2026-53580 Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...

CVE-2026-53580: External Control of File Name or Path

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...

PT-2026-99568

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.16.1 Description The software fails to revalidate share access when restoring cached navigator state from a context hint UUID. This allows attackers who previously held valid share access to replay the cached hint...

PYSEC-2026-3731

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...

CVE-2026-65915: Improper Access Control

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...

WordPress Forminator cross-site scripting vulnerability

WordPress Forminator is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress Forminator has a cross-site scripting vulnerability. This vulnerability arises from ForminatorCore::sanitizearray, which skips fields starting with “select”, and setfieldda...

CVE-2026-48912 Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL

Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs. Users are recommended to upgrade to...

CVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-65698

A flaw was found in Void through 1.3.4 in the AI agent file-reading tools readfile, lsdir, getdirtree, and search. Those tools do not confine paths to the open workspace and can accept absolute paths or file:// URIs, including bypassing the approval gate. An attacker who can inject instructions...