Arbitrary File Read

github.com/hahwul/dalfox/v2 is vulnerable to Arbitrary File Read. The vulnerability is due to unsafe deserialization of the attacker-controlled custom-payload-file parameter in REST API server mode, which allows an unauthenticated attacker to read arbitrary files accessible to the dalfox process...

PT-2026-41430

Syncplify.me Server! 5.0.37 contains an unquoted service path vulnerability in the SMWebRestServicev5 service that allows local attackers to escalate privileges by exploiting the unquoted binary path. Attackers can insert a malicious executable into the service path and execute it with LocalSyste...

CVE-2026-44516

Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers...

CVE-2026-46407

Vvveb CMS contains an IDOR in the backend/admin/auth-token endpoint. An authenticated administrator can load another admin's REST API token list by supplying that user’s admin_id, leading to disclosure of sensitive tokens. The issue is fixed in version 1.0.8.3. No exploitation details are provide...

CVE-2026-46407 Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to load another administrator's REST API token list by supplying that user's adminid. This can...

CVE-2026-46407 Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to load another administrator's REST API token list by supplying that user's adminid. This can...

com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.1) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.1)

com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.1 Source cves: CVE-2026-45575 Source advisory: GHSA-GQX7-6552-67HF...

com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.1) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.1)

com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.1 Source cves: CVE-2026-45575 Source advisory: OSV:GHSA-GQX7-6552-67HF...

com.oviva.telematik:epa4all-rest-service (0.0.5) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (0.0.5)

com.oviva.telematik:epa4all-client MAVEN version 0.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.5 Source cves: CVE-2026-45575 Source advisory:...

com.oviva.telematik:epa4all-rest-service (0.0.7) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (0.0.7)

com.oviva.telematik:epa4all-client MAVEN version 0.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.7 Source cves: CVE-2026-45575 Source advisory:...

com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.1) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.1)

com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.1 Source cves: CVE-2026-45575 Source advisory: SNYK:JAVA-COMOVIVATELEMATIK-17277595...

com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.1), com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.1) +1 more potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-vau-client (>=1.0.0, <=1.2.1)

com.oviva.telematik:epa4all-vau-client MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.1 Source cves: CVE-2026-45575 Source advisory: SNYK:JAVA-COMOVIVATELEMATIK-17277596...

com.oviva.telematik:epa4all-rest-service (0.0.4) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (0.0.4)

com.oviva.telematik:epa4all-client MAVEN version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.4 Source cves: CVE-2026-45575 Source advisory:...

com.oviva.telematik:epa4all-rest-service (0.0.8) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (0.0.8)

com.oviva.telematik:epa4all-client MAVEN version 0.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.8 Source cves: CVE-2026-45575 Source advisory:...

com.oviva.telematik:epa4all-rest-service (0.0.5) potentially affected by CVE-2026-45574 via com.oviva.telematik:epa4all-client (0.0.5)

com.oviva.telematik:epa4all-client MAVEN version 0.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.5 Source cves: CVE-2026-45574 Source advisory:...

com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.1) potentially affected by CVE-2026-45574 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.1)

com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.1 Source cves: CVE-2026-45574 Source advisory: OSV:GHSA-5HHF-XMFX-4VVR...

com.oviva.telematik:epa4all-rest-service (0.0.7) potentially affected by CVE-2026-45574 via com.oviva.telematik:epa4all-client (0.0.7)

com.oviva.telematik:epa4all-client MAVEN version 0.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.7 Source cves: CVE-2026-45574 Source advisory:...

com.oviva.telematik:epa4all-rest-service (0.0.8) potentially affected by CVE-2026-45574 via com.oviva.telematik:epa4all-client (0.0.8)

com.oviva.telematik:epa4all-client MAVEN version 0.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.8 Source cves: CVE-2026-45574 Source advisory:...

com.oviva.telematik:epa4all-rest-service (0.0.4) potentially affected by CVE-2026-45574 via com.oviva.telematik:epa4all-client (0.0.4)

com.oviva.telematik:epa4all-client MAVEN version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.4 Source cves: CVE-2026-45574 Source advisory:...

com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.1) potentially affected by CVE-2026-45574 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.1)

com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.1 Source cves: CVE-2026-45574 Source advisory: SNYK:JAVA-COMOVIVATELEMATIK-17326433...