463875 matches found
CVE-2026-96424
Incorrect DBus policy for lomiri-upload-manager part of lomiri-download-manager allows arbitrary user to read arbitrary file as root over DBus...
CVE-2026-92263
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...
UBUNTU-CVE-2026-96425
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus...
CVE-2026-96425
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus...
CVE-2026-41582
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...
CVE-2026-41582
The countly-server component of the Countly product analytics solution is vulnerable to a path traversal vulnerability prior to versions 24.05.50 and 25.03.44 . The root cause is the concatenation of attacker-controlled wildcard paths without containment validation in specific routes located in f...
CVE-2026-41582 countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...
CVE-2026-41582 countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...
CVE-2026-41582
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...
CVE-2026-41582 countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...
EUVD-2026-102917
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...
CVE-2026-92263
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...
EUVD-2026-102913
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...
CVE-2026-96425 Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus...
CVE-2026-96425 Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus...
CVE-2026-96425
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus...
CVE-2026-96425
The lomiri-download-manager software contains an incorrect DBus policy that allows an arbitrary user to execute arbitrary commands with root privileges over DBus. This vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource). The provided documents do not ...
CVE-2026-96425 Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus...
CVE-2026-96424
The lomiri-download-manager suite is vulnerable due to an incorrect DBus policy within the lomiri-upload-manager component. This misconfiguration allows an arbitrary user to perform an arbitrary file read as root over DBus. The vulnerability is classified under CWE-732 (Incorrect Permission Assig...
CVE-2026-96424 Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
Incorrect DBus policy for lomiri-upload-manager part of lomiri-download-manager allows arbitrary user to read arbitrary file as root over DBus...