FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

SUSE CVE-2026-15771

Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-45806 Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in...

CVE-2026-45806

Penpot before 2.15.0 vulnerable to authenticated SSRF in remote image import. The flow passes a user-controlled URL from frontend to the backend RPC method create-file-media-object-from-url, where media/download-image uses a shared HTTP client without destination filtering, allowing an authentica...

CVE-2026-56400

creationtimestamp| type| source ---|---|--- 2026-07-15 12:38:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqoqg5mume2p 2026-07-15 15:43:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp2rmdoce2e 2026-07-17 04:37:06+00:00| seen|...

EUVD-2026-44651

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension inspects only the final file extension via pathinfo$filename, PATHINFOEXTENSION, so a user with api.media.write permission can...

CVE-2026-61457 Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension inspects only the final file extension via pathinfo$filename, PATHINFOEXTENSION, so a user with api.media.write permission can...

CVE-2026-11579

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...

CVE-2026-11579

CVE-2026-11579 affects the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin up to version 2.4.17. The issue arises because the plugin does not verify that a file upload is tied to an existing form with a file-upload field, allowing unauthenticated users to upload files to the Wo...

CVE-2026-11579

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...

EUVD-2026-44592

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...

CVE-2026-11579 Kali Forms < 2.4.17 - Unauthenticated Media Upload

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...

OPENSUSE-SU-2026:11277-1 grafana-12.4.5-1.1 on GA media

These are all security issues fixed in the grafana-12.4.5-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11283-1 python313-Pillow-12.3.0-2.1 on GA media

These are all security issues fixed in the python313-Pillow-12.3.0-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11285-1 python310-3.10.20-7.1 on GA media

These are all security issues fixed in the python310-3.10.20-7.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11275-1 aws-nitro-enclaves-binaryblobs-upstream-1.4.5~git0.18a5f6f-1.1 on GA media

These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.4.5git0.18a5f6f-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11273-1 ImageMagick-7.1.2.27-2.1 on GA media

These are all security issues fixed in the ImageMagick-7.1.2.27-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11276-1 gpsd-3.27.5-3.1 on GA media

These are all security issues fixed in the gpsd-3.27.5-3.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11281-1 opennlp-1.9.5-1.1 on GA media

These are all security issues fixed in the opennlp-1.9.5-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11274-1 agama-22+398.d23cf880d-49.1 on GA media

These are all security issues fixed in the agama-22+398.d23cf880d-49.1 package on the GA media of openSUSE Tumbleweed...