CVE-2026-63130

The open source customer relationship management application EspoCRM is vulnerable to a path traversal flaw in the LabelManager (specifically during Custom Label saving) prior to version 9.3.10 . An authenticated administrator can provide crafted input to bypass insufficient path validation, allo...

VulnCheck KEV: CVE-2026-49049

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters...

EUVD-2026-40997

A vulnerability has been identified in the Feast Feature Server’s /save-document endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file locations, these protections can be bypassed, enabling a...