PT-2026-57284

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.2 Description The user edit flow stores the url-previous value from the attacker-controlled Referer header into the Laravel intended URL session value. When redirect option=back is submitted, the system uses...

TraceQL DoS

The vulnerability of the TraceQL query language used in Grafana Tempo’s storage and analysis software for distributed trace data involves an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Grafana Tempo DoS

The vulnerability of the software for storing and analyzing distributed tracebacks of Grafana Tempo is related to an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

CVE-2026-61455: Improper Handling of Highly Compressed Data (Data Amplification)

Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage...

VulnCheck KEV: CVE-2026-2699

Customer Managed ShareFile Storage Zones Controller SZC allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution...

CVE-2026-56309: Allocation of Resources Without Limits or Throttling

Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. Attackers can upload arbitrary attachments using upload-scoped API keys that bypass plan checks, persist outside normal bund...

EUVD-2026-42746

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without the publish-access filtering used by sibling storage endpoints, allowing a publish-mode Reader to read private...

CVE-2026-58144

Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle parameter processed through the TXT filter in pfs.main.php. Attackers can create a...

CVE-2026-46413

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5...

baybars (>=0.0.1, <=0.0.5) potentially affected by CVE-2022-30187 via azure-storage-queue (0.37.0)

azure-storage-queue PYPI version 0.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-queue and may be impacted: - baybars =0.0.1, =0.0.5 Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-2388...

Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library

SummaryThe Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. SeverityModerat...

vfxt (>=0.5.2.1, <=0.5.4.3) potentially affected by CVE-2022-30187 via azure-storage-queue (2.0.1)

azure-storage-queue PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-queue and may be impacted: - vfxt =0.5.2.1, =0.5.4.3 Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-2388...

azure-kusto-ingest (>=0.0.38, <=0.0.45), c7n-azure (>=0.7.0, <=0.7.9) +2 more potentially affected by CVE-2022-30187 via azure-storage-queue (2.1.0)

azure-storage-queue PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-queue and may be impacted: - azure-kusto-ingest =0.0.38, =0.7.0, =0.0.1, =0.0.4 - npyetl 0.0.5 Source cves: CVE-2022-30187 Source advisory:...

appdaemon (>=4.0.4, <=4.0.5), aviatrix-discovery (>=0.2.100, <=0.2.148) +18 more potentially affected by CVE-2022-30187 via azure-storage-queue (1.4.0)

azure-storage-queue PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-queue and may be impacted: - appdaemon =4.0.4, =0.2.100, =0.2.123, =3.0.0, =1.0.86, =1.0.0, =0.0.2, =0.0.1, =0.15.8, =0.2.10, =1.12.1, =2.4.1 and more...

PYSEC-2026-2388 Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library

Summary The Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. Severity...

ALPINE-CVE-2026-42486

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. XAPI can configure different users with different roles, using Role Based Access Control. For more details, see:...

CVE-2026-23562

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. XAPI can configure different users with different roles, using Role Based Access Control. For more details, see:...

CVE-2026-23561

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. XAPI can configure different users with different roles, using Role Based Access Control. For more details, see:...

ALPINE-CVE-2026-23561

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. XAPI can configure different users with different roles, using Role Based Access Control. For more details, see:...

ALPINE-CVE-2026-23562

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. XAPI can configure different users with different roles, using Role Based Access Control. For more details, see:...