CVE-2026-46581

In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target...

CVE-2026-46581

CVE-2026-46581 affects Eclipse Mojarra 2.3 and later. The vulnerability lies in how the URL handing in DefaultFaceletFactory handles remote URLs, failing to sanitize or block them, allowing an attacker to specify a URL to a remote Facelet that can be included and processed with the server’s privi...

CVE-2026-61891

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...

CVE-2026-61891

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...

CVE-2026-61891

CVE-2026-61891 affects Eclipse Theia up to 1.73.1, specifically the @theia/filesystem backend. The HTTP endpoints GET /file, GET /files/, and PUT /files/ map a client-supplied URI directly to a filesystem path and stream the file, without confinement to the workspace or any allow-listed root. In ...

EUVD-2026-53327

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...

CVE-2026-61891

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...

CVE-2026-60009

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart uri field and calls fs.movetmp, target, overwrite: true with no workspace...

CVE-2026-71252

toner-management's admin state-changing handlers add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforce...

EUVD-2026-53325

toner-management's admin state-changing handlers add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforce...

EUVD-2026-53324

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

CVE-2026-71251 Akaunting: Cross-Company Media IDOR in Customer Portal Download Endpoint

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

CVE-2026-71251

CVE-2026-71251 (Akaunting) : The shared download route app/Http/Controllers/Common/Uploads.php::download() allowed an authenticated portal customer to fetch any Media by ID without verifying ownership. This constitutes a cross-company IDOR: a user could download another company’s uploaded files b...

CVE-2026-71250 Firefly III: Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding

Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...

CVE-2026-71249 299Ko: Unauthenticated Reflected XSS in Public Contact Form

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-71248 Inventory-Management-System-PHP: Unauthenticated SQL Injection in Login and Product Deletion

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select from user where email = '$email' and password = '$password'", with no escaping or parameterization, allowing authentication bypass via a payload...

CVE-2026-71248

The CVE concerns Inventory-Management-System-PHP. login.php builds its query by direct string concatenation of POST parameters for authentication, enabling authentication bypass (e.g., email=' OR 1=1 LIMIT 1-- -). Separately, delete.php runs a DELETE without auth checks or input validation for id...

CVE-2026-71247

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. The handler upserts a...

CVE-2026-71246 Pixelfed: Authenticated SSRF via Remote URL Search

Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...

CVE-2026-71246 Pixelfed: Authenticated SSRF via Remote URL Search

Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...