CVE-2026-82833

A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. Affected by this issue is the function ExampleDetail of the file /v1/projects/1/examples/ of the component...

CVE-2026-82833 Doccano Open Source Annotation Tools for Machine Learning Practitioners Project Example Detail Endpoint examples ExampleDetail access control

A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. Affected by this issue is the function ExampleDetail of the file /v1/projects/1/examples/ of the component...

CVE-2026-82833

An improper access control vulnerability exists in the ExampleDetail function of the Project Example Detail Endpoint (/v1/projects/1/examples/) in Doccano (open-source annotation tool for ML practitioners), affecting versions up to 1.8.5 . The flaw allows a remote attacker with low privileges to ...

CVE-2026-82833

A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. Affected by this issue is the function ExampleDetail of the file /v1/projects/1/examples/ of the component...

CVE-2026-53552 Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the...

CVE-2026-53552

Goploy is an open-source automation deployment system (github.com/zhenorzz/goploy). In versions 1.17.5 and prior , the project handlers (Project.AddFile, Project.EditFile, Project.RemoveFile, Project.Edit in cmd/server/api/project/handler.go) accept a project or project-file row ID from the JSON ...

CVE-2026-82679

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may ...

CVE-2026-82679 diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may ...

EUVD-2026-68460

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may ...

CVE-2026-82679 diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may ...

CVE-2026-82679 diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may ...

CVE-2026-82679

An unrestricted file upload vulnerability exists in diem-project/diem (up to version 5.1.3 ), located in the Widget Editor component within the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php. The root cause is an unknown function that fails to properly restrict upload hand...

CVE-2026-82679

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may ...

CVE-2026-82678 diem-project diem Administrative Console actions.class.php executeCommand os command injection

A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dmcommand leads to os command...

CVE-2026-82678 diem-project diem Administrative Console actions.class.php executeCommand os command injection

A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dmcommand leads to os command...

CVE-2026-82678

diem-project diem (up to 5.1.3 ) contains an OS command injection vulnerability in the Administrative Console component. The affected element is the executeCommand function in dmAdminPlugin/modules/dmConsole/actions/actions.class.php , where manipulation of the dm_command argument allows command ...

CVE-2026-82678

A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dmcommand leads to os command...

EUVD-2026-68459

A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dmcommand leads to os command...

CVE-2026-82726

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

CVE-2026-81852

Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...