CVE-2026-110225

Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata...

EUVD-2026-99010

Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata...

CVE-2026-110225

Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata...

PT-2026-111348

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in...

Shaarli Community: Shaarli Server Request Forgery Vulnerability

The Shaarli Community version 0.16.9 and earlier contain a server-side request forgeing vulnerability. This vulnerability stems from server-side request forgeing, where private addresses are not checked during the retrieval of bookmark thumbnails. Certified users can manipulate server requests to...

Forensic Text Recovery from Document Thumbnails Using Text-Aware U-Net

Forensic analysis of low-resolution Word thumbnails presents a significant challenge because these artifacts may constitute the only remaining visual evidence of deleted documents. Standard Optical Character Recognition OCR tools perform poorly on such severely degraded images, creating a critica...

CVE-2026-96394

The Affinity by Canva application for macOS before 3.3.1 October 2026 release did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an...

CVE-2026-96396

The Affinity by Canva application for macOS versions prior to 3.3.1 (October 2026 release) is vulnerable to an integer overflow leading to a heap-based buffer overflow . The flaw occurs because the application does not safely calculate the size of an image buffer when generating QuickLook thumbna...

CVE-2026-96394

The Affinity by Canva application for macOS before 3.3.1 October 2026 release did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an...

CVE-2026-96396: Heap-based Buffer Overflow

The Affinity by Canva application for macOS before 3.3.1 October 2026 release did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could...

CVE-2026-105649

The Ghost Node.js content management system is vulnerable to Stored Cross-Site Scripting (XSS) in versions 4.22.0 through 6.65.0 . The root cause is a lack of sanitization for SVG media thumbnails and SVG images uploaded using non-SVG file extensions. This flaw allows any staff user, including Co...

CVE-2026-105649: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in...

CVE-2026-65422

A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails...

CVE-2026-65422

A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails...

EUVD-2026-85917

A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails...

CVE-2026-65422

A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails...

CVE-2026-65422

A flaw in the authorization mechanism for the Media Gateway API in Genetec Security Center may allow a user lacking playback privileges to generate video thumbnails . The vulnerability impacts confidentiality as indicated by the CVSS score. Remediation is available in Security Center version 5.14...

CVE-2026-65422: Missing Authorization

A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails...

PT-2026-97833

Name of the Vulnerable Software and Affected Versions Genetec Security Center affected versions not specified Description A flaw in the authorization mechanism for the Media Gateway API allows a user without playback privileges to generate video thumbnails. Recommendations At the moment, there is...

CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...