CVE-2026-113875

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access...

EUVD-2026-108275

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access...

CVE-2026-100540 OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

CVE-2026-34151

XWiki Platform prior to 17.10.5 and 18.2.0 is vulnerable to resource path traversal via the /skin/ action endpoint (com.xpn.xwiki.web.SkinAction) when running on Jetty 12 or later . Jetty 12's decoding of the request path allows double-encoded parent-directory sequences (..%252f) to escape the in...

EUVD-2022-51060

Malicious code in bioql PyPI...

CVE-2022-48361

The Always On Display AOD has a path traversal vulnerability in theme files. Successful exploitation of this vulnerability may cause a failure in reading AOD theme resources...

CVE-2024-24749

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer is deployed in the Windows operating system using an Apache Tomcat web application server, it is possible to bypass existing input validation in the GeoWebCach...

CVE-2022-48361

The Always On Display AOD has a path traversal vulnerability in theme files. Successful exploitation of this vulnerability may cause a failure in reading AOD theme resources...