298794 matches found
CVE-2026-48051
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local,...
CVE-2026-48051 Papra: SSRF via HTTP redirect bypass in webhook delivery
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local,...
EUVD-2026-49386
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which...
CVE-2026-54540 Authenticated terminal command whitelist bypass in Pheditor
Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command...
CVE-2026-64643 Next.js: Unauthenticated Disclosure of Internal Server Function endpoints
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions use server or use cache endpoints can be disclosed bypassing any authentication on the pages where these...
CVE-2026-64643
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions use server or use cache endpoints can be disclosed bypassing any authentication on the pages where these...
CVE-2026-64643 Next.js: Unauthenticated Disclosure of Internal Server Function endpoints
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions use server or use cache endpoints can be disclosed bypassing any authentication on the pages where these...
CVE-2026-64643
CVE-2026-64643 affects Next.js (versions 12.0.0–15.5.20 and 16.0.0–16.2.10) where apps using App Router, Server Actions (use server) or cache endpoints can disclose internal Server Action IDs and endpoints to unauthenticated users via publicly served client artifacts. This disclosure allows unaut...
CVE-2026-64641
Next.js CVE-2026-64641 describes a denial-of-service in App Router when using at least one Server Action. Affected versions are 13.0.0–15.5.20 and 16.0.0–16.2.10; crafted requests can cause excessive CPU usage that blocks processing of further requests within the same process. The issue is fixed ...
CVE-2026-64641 Next.js: Denial of Service in App Router using Server Actions
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further...
CVE-2026-64641
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further...
CVE-2026-64641 Next.js: Denial of Service in App Router using Server Actions
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further...
CVE-2026-17570
CVE-2026-17570 : Improper access control in the PAM password history endpoints of Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. Affected: Devolutions Server 2026.2.4.0–2026.2.12.0 and 2026.1.23.0 and earlier. CVSS...
EUVD-2026-49380
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2026.1.23.0...
CVE-2026-17570
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2026.1.23.0...
CVE-2026-17570
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2026.1.23.0...
CVE-2026-17569
Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...
CVE-2026-17569
CVE-2026-17569: Improper access control in the NetBox synchronizer of Devolutions Server allows an authenticated user with view-only access on an entry to retrieve a stored API token via the partial connection endpoint. Affected products/versions include Devolutions Server 2026.2.4.0 through 2026...
EUVD-2026-49379
Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...
CVE-2026-17569
Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...