CVE-2026-63219

CVE-2026-63219 (CVSS 8.6) is a missing authorization check on the GeoNetwork formatter upload API endpoint, affecting versions prior to 4.4.12 and 4.2.17 . An unauthenticated attacker can upload arbitrary .xsl or .zip files into the server formatter directory, granting unauthorized write access. ...

CVE-2026-63219 Unauthenticated file upload via missing authorization on formatter upload endpoint

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary .x...

EUVD-2026-70647

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary .x...

CVE-2026-63219 Unauthenticated file upload via missing authorization on formatter upload endpoint

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary .x...

CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-75602

OpenList (a file list program supporting multiple storage backends) versions prior to 4.2.3 are affected by an authenticated path traversal vulnerability in the offline-download feature. When the SimpleHttp tool is used via POST /api/fs/add_offline_download, an attacker-controlled Content-Disposi...

CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An...

CVE-2026-85176 DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...

CVE-2026-85176 DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...

CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in its REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation, allowing an unauthenticat...

CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An...

CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An...

EUVD-2026-70479

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An...

CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An...

USN-8723-1: SPICE vdagent vulnerabilities

It was discovered that SPICE vdagent had an integer overflow in the buffer size calculation used when writing to the daemon socket. A malicious or compromised SPICE host could possibly use this issue to cause SPICE vdagent to crash, resulting in a denial of service. CVE-2026-57965 It was discover...

USN-8723-1 spice-vdagent vulnerabilities

It was discovered that SPICE vdagent had an integer overflow in the buffer size calculation used when writing to the daemon socket. A malicious or compromised SPICE host could possibly use this issue to cause SPICE vdagent to crash, resulting in a denial of service. CVE-2026-57965 It was discover...

supernote-obsidian-plugin-PoC

Summary CVE status: requested, pending assignment. This...

PT-2026-85305

Name of the Vulnerable Software and Affected Versions MOOS-IvP versions prior to 24.8.2 Description The SplitHandler fails to properly validate variable names extracted from alog files. On Windows systems, an attacker can provide specially crafted alog files containing backslash sequences in...