EUVD-2026-95906

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...

CVE-2026-108158

The plugNmeet Server through 2.5.2 version is vulnerable to a path traversal vulnerability in the /api/whiteboard/convert endpoint. An authenticated meeting participant can provide crafted filePath values containing ../ sequences to force the server to convert arbitrary files into page images. Th...

CVE-2026-108158 plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...

rails-activestorage-vips-audit

rails-activestorage-vips-audit An Agent Skill that audits Ruby on Rails repositories for exposure to CVE-2026-66066 KindaRails2Shell — the Active Storage libvips variant-processing vulnerability that allows arbitrary file read and, in a Rails application, remote code execution. The skill is a...

CVE-2026-108103

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsedroppeddltrafficthreshold that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 wi...

CVE-2026-108102

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...

Fonoster-LFI-PoC

CVE-2024-43035 - Prueba de Concepto de LFI en Fonoster Este repositorio contiene un script de Prueba de Concepto PoC que demuestra una vulnerabilidad de Inclusión de Archivos Locales en Fonoster. Esta herramienta es solo para fines educativos y pruebas autorizadas. Uso Leer Archivo Local Para...

CVE-2026-108110

The MOVO application (versions through 0.2.3 ) contains an authorization bypass vulnerability within the chat-api document endpoints. The root cause allows authenticated users to access other users' stored objects by supplying arbitrary object paths . Specifically, an attacker who knows a target'...

EUVD-2026-95883

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...

EUVD-2026-95794

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsedroppeddltrafficthreshold that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 wi...

CVE-2026-108103

Versions of Open5GS through 2.8.0 are vulnerable to a heap out-of-bounds read in the ogs_pfcp_parse_dropped_dl_traffic_threshold() function. This flaw allows remote unauthenticated attackers to read past IE buffers by sending PFCP Session Establishment or Modification Requests to the UPF on UDP p...

CVE-2026-108103 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsedroppeddltrafficthreshold that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 wi...

CVE-2026-108103 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsedroppeddltrafficthreshold that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 wi...

CVE-2026-108102 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...

CVE-2026-108102 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...

EUVD-2026-95793

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...

CVE-2026-108102

The Open5GS project (versions through 2.8.0 ) contains a heap out-of-bounds read vulnerability within the ogs_pfcp_parse_volume_measurement() function in lib/pfcp/types.c. This flaw allows remote unauthenticated attackers to read past Information Element (IE) buffers by sending a PFCP Session Rep...

CVE-2026-108102 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...

CVE-2026-108100 HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter

HortusFox hortusfox-web before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted includeinfo values to the /api/locations/list endpoint. Attackers can place subqueries in includeinfo, which PlantsModel::getSpecificInfo concatenates into t...

CVE-2026-56718

CVE-2026-56718 Unauthenticated path traversal in jdbhttpd/0.1.0 AJCloud AJY IPC firmware allowing remote reading of arbitrary files as root, including cleartext RTSP credentials. CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory Severity: CVSS 4.0 - 8.7 High Affected: AJClou...