300239 matches found
CVE-2026-55696
PrivateBin versions prior to 2.0.5 contain a stored XSS vulnerability in the attachment download link. The root cause is that DOMPurify sanitization in AttachmentViewer.setAttachment only applies to image/*svg MIME types, and the resulting sanitized blob is assigned to a local variable used for t...
EUVD-2026-67938
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...
CVE-2026-55696 PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...
CVE-2026-82271
R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users'...
CVE-2026-55547
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET...
CVE-2026-55634 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/id/import accepts a DataObject field name that is emitted without an identifier allowlist b...
CVE-2026-55673 PowSyBl: Command Injection in LocalCommandExecutor-s
PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...
CVE-2026-55673
PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...
User Impersonation
Overview Affected versions of this package are vulnerable to User Impersonation via the readconfig.php process. An attacker can gain unauthorized access to sensitive system information by sending spoofed X-Forwarded-For or Client-IP HTTP headers to impersonate a trusted IP address. Remediation...
piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
Summary piccoloadmin uses a helper called superuservalidators to gate access to the user and session tables for non-superusers. The helper rejects PUT, PATCH, DELETE, and POST, but does not reject GET. The sessions table stores live session tokens in plaintext, and the token column is not marked...
Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields
Impact A vulnerability was found in Graylog's API endpoint for retrieving system catalog entity titles. Authenticated users could retrieve database fields of supported entities by sending a custom API request. These fields can include e.g. the password hash of a user but not the password itself,...
CVE-2026-55425
Graylog (free and open log management platform) has an authorization flaw in the System Catalog entity titles endpoint (EntityTitleServiceImpl.java). An authenticated user can request composite display fields without the server verifying that every selected field is readable, allowing retrieval o...
CVE-2026-55425 Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields
Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...
CVE-2026-55425 Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields
Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...
CVE-2026-81849 Path traversal in the aws:downloadContent plugin in amazon-ssm-agent
Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the...
Snipe-IT has missing object-level authorization in Kits API
Impact The API endpoint for adding a license to a predefined kit POST /api/v1/kits/kitid/licenses only checks whether the caller can edit kits, but does not perform object-level authorization on the referenced license itself. Because of this, a low-privilege user with only predefined-kit...
GHSA-53JC-27PC-X8R8 Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
Impact The route POST /account/request/itemType/itemId/cancelbyadmin?/requestingUser? accepts cancelbyadmin as a plain URL path segment with no authorization check. Any authenticated user regardless of permissions can set this parameter to a truthy value and supply a victim's user ID to silently...
CVE-2026-56100
SpringBlade versions 2.7.3 through 3.5.0 are affected by a privilege escalation vulnerability in an internal Feign user-creation endpoint exposed via @RestController without authorization checks. The gateway's authentication filter only validates JWT parsing without verifying user roles or caller...
Snipe-IT vulnerable to stored XSS via inline-served attachment
Impact A low-privilege user can store an active-content payload as an asset attachment and have it served inline, same-origin, with an active Content-Type, achieving stored XSS. The application sanitizes uploads only when PHP finfo detects image/svg+xml. By submitting an XHTML document whose finf...