CVE-2026-123197

WPPConnect Server versions through 2.10.76 are vulnerable to an unauthenticated sticker media disclosure vulnerability. The root cause is a missing authentication check on the /files static mount. Attackers can bypass per-session token checks by enumerating Unix timestamps in GET /files/file.webp...

CVE-2026-123197 WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files

WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file.webp requests to retrieve stickers from any session,...

CVE-2026-104203 Traccar: Authentication bypass via path parameters exposes protected device media

Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/. An unauthenticated attacker who knows or guesses a device unique ID and...

CVE-2026-104203

The open source GPS tracking system Traccar (versions 5.1 until 6.15.0) contains a vulnerability where an unauthenticated attacker can bypass session and device authorization checks. The root cause is a discrepancy in routing meanings for path parameters at /api/media/* between WebModule.java's M...

CVE-2026-90898

creationtimestamp| type| source ---|---|--- 2026-09-14 11:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvhxwzsz522f 2026-09-14 12:07:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvi35ifopn2j 2026-09-14 12:27:21+00:00| seen|...

CVE-2026-53758

creationtimestamp| type| source ---|---|--- 2026-09-13 03:20:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mven7kepma2c 2026-09-13 03:20:04+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117261572665056684...

CVE-2026-80880

creationtimestamp| type| source ---|---|--- 2026-09-12 16:30:05+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvdivb4msn2v 2026-09-12 16:30:07+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117259016840650116...

CVE-2026-71626

creationtimestamp| type| source ---|---|--- 2026-09-12 10:20:20+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvcua6jlfb2b 2026-09-12 10:20:28+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117257563005397473...

CVE-2026-75162

creationtimestamp| type| source ---|---|--- 2026-09-11 21:50:04+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117254612752271368 2026-09-11 21:50:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvbkcjpdpc2o...

CVE-2026-75650

creationtimestamp| type| source ---|---|--- 2026-09-07 20:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117231650321650010 2026-09-07 20:30:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3muxdyiw3nj2z 2026-09-07 21:35:40+00:00| seen|...

PT-2026-73125

Name of the Vulnerable Software and Affected Versions CatFolders Document Gallery & PDF Library WordPress plugin versions prior to 2.0.7 Description Lack of authorization checks in certain REST API endpoints allows unauthenticated users to retrieve sensitive information about media attachments...

CVE-2025-9218

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handlerestpredispatch function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to...

CVE-2025-9218

The CVE-2025-9218 entry concerns rtMedia for WordPress, BuddyPress and bbPress. Wordfence reports a missing-authorization issue in rtMedia’s handle_rest_pre_dispatch() that, when the Godam plugin is active, allows unauthenticated attackers to access media items from draft or private posts. Affect...

CVE-2024-49728

In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-49728

In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-49728: Externally Controlled Reference to a Resource in Another Sphere

In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-296915500

In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40108

In multiple locations, there is a possible way to access media content belonging to another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21105

In multiple functions of ChooserActivity.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11...

PT-2022-14619 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-11 through Android-12L Description: The issue is related to an integer overflow in the extract3GPPGlobalDescriptions function of TextDescriptions.cpp, which can cause an out of bounds read. This could lead to local...