CVE-2026-126946

Zipline versions 4.3.0 before 4.5.0 are vulnerable to a stored cross-site scripting (XSS) flaw in SSR meta tags. The root cause is the failure to escape input for embed settings , specifically the embedTitle, embedDescription, embedSiteName, and embedColor fields. Authenticated low-privilege user...

CVE-2026-126949

Zipline through version 4.4.0 is vulnerable to a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint. This flaw allows authenticated users with high privileges to overwrite existing uploads by providing unsanitized names . Because the system performs a database uniquenes...

EUVD-2026-124142

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

CVE-2026-126932

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

CVE-2026-126932

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

CVE-2026-126932 Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

CVE-2026-126932

Zipline versions 4.6.2 before 4.8.0 are vulnerable to a policy bypass vulnerability. This flaw allows authenticated users to evade administrator-imposed restrictions on MIME types by manipulating file metadata. An attacker can upload a permitted file and subsequently use the PATCH /api/user/files...

CVE-2026-126932 Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

CVE-2026-126932: diced zipline: Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade…

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

PT-2026-145628

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

CVE-2026-76837: Improper Neutralization of Input During Web Page Generation

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...