12607 matches found
CVE-2026-68533
Concrete CMS versions below 9.5.3 have a missing authorization flaw in the conversation attachment upload endpoint. The endpoint imported files into the file manager before checking the "Add Message Attachments" permission, meaning a user lacking that permission—or an unauthenticated visitor on a...
CVE-2026-68533 Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Message Attachments Permission
Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. A user denied that permission, or an unauthenticated visitor on a guest-postin...
CVE-2026-12742
IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls...
CVE-2026-12742 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026
IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls...
CVE-2026-12742 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026
IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls...
CVE-2026-12742
IBM Business Automation Workflow (both containers and traditional deployments) is affected by a missing authorization control that allows an authenticated attacker to trigger restricted import actions. The root cause is insufficient authorization checks on import-related functions. Per CVSS 3.1, ...
EUVD-2026-78870
IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls...
CVE-2026-91979
Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance...
CVE-2026-54077
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to...
CVE-2026-91979 Vikunja before 2.6.0 Denial of Service via Decompression Bomb
Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance...
CVE-2026-91979 Vikunja before 2.6.0 Denial of Service via Decompression Bomb
Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance...
CVE-2026-91979 Vikunja before 2.6.0 Denial of Service via Decompression Bomb
Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance...
CVE-2026-91979
Vikunja (a self-hosted task management application) prior to 2.6.0 does not limit archive expansion during data import. An authenticated attacker can upload a highly compressed file that expands to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance (denial...
EUVD-2026-78650
Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance...
CVE-2026-54077
ArcadeDB (Multi-Model DBMS) prior to 26.6.1 contained a vulnerability in the IMPORT DATABASE statement, which did not require administrative privileges and passed unvalidated source URLs to SourceDiscovery.java. An authenticated user with SQL access via /api/v1/command or /api/v1/query could trig...
EUVD-2026-78786
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to...
CVE-2026-54077 ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to...
CVE-2026-54077 ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to...
CVE-2026-54077 ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to...
