110119 matches found
CVE-2026-63498 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/objecttype/id/files/fileid allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The...
CVE-2026-97226
A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initia...
CVE-2026-97226 DbGate files-style Endpoint files.js fs.readFile path traversal
A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initia...
CVE-2026-97226
A path traversal vulnerability exists in DbGate versions up to 7.2.5 and 7.3.1-premium-beta.1. The flaw is located within the files-style Endpoint component, specifically in the fs.readFile function of the packages/api/src/controllers/files.js file. By manipulating the filePath/uri argument, an a...
EUVD-2026-86252
A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initia...
CVE-2026-97226 DbGate files-style Endpoint files.js fs.readFile path traversal
A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initia...
CVE-2026-77825
IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...
EUVD-2026-85887
Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the...
CVE-2026-77797 Velociraptor Prefetch parser out of bounds
Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files...
CVE-2026-88843
The MasterStudy LMS WordPress Plugin (versions before 3.7.50 ) contains a vulnerability where a display-style setting is not properly validated when building a template path. This flaw allows users with the Contributor role or higher to perform local file inclusion and execute arbitrary local PHP...
EUVD-2026-85801
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...
USN-8810-1 imagemagick vulnerabilities
It was discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS...
USN-8810-1: ImageMagick vulnerabilities
It was discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS...
PT-2026-97804
Name of the Vulnerable Software and Affected Versions Aureus ERP versions prior to 1.6.1 Description The application stores uploaded SVG files on its public disk and serves them from the application origin. This allows authenticated users to upload malicious SVG files containing JavaScript...
PT-2026-97834
Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description Recursive copying of directories is permitted without proper controls, which may result in the unintentional inclusion of unnecessary or sensitive files and an increased attack surface...
PT-2026-97798
Name of the Vulnerable Software and Affected Versions rpm affected versions not specified Description A flaw exists where the software processes crafted manifest files during operations such as rpm -q -p or similar manifest-processing flows. The issue occurs because manifest entries undergo...
FreeBSD : podman -- vulnerabilities (050e54b4-b81e-11f1-b540-589cfc10a551)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 050e54b4-b81e-11f1-b540-589cfc10a551 advisory. The Podman developers report: This release addresses CVE-2025-11395, where importing images...
CVE-2026-93290: Use of Hard-coded Credentials
Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data...
CVE-2026-97062: Improper Neutralization of Input During Web Page Generation
Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the...
CVE-2026-77797: Improper Input Validation
Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files...