CVE-2026-14314 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...

CVE-2026-19000

A vulnerability was identified in JeecgBoot up to 3.9.2. The affected element is an unknown function of the file /airag/chat/send of the component Anonymous Chat Attachment Parser. The manipulation leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-19000 JeecgBoot Anonymous Chat Attachment send server-side request forgery

A vulnerability was identified in JeecgBoot up to 3.9.2. The affected element is an unknown function of the file /airag/chat/send of the component Anonymous Chat Attachment Parser. The manipulation leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-19000

CVE-2026-19000 affects JeecgBoot up to version 3.9.2. The vulnerability resides in the Anonymous Chat Attachment Parser component, specifically the /airag/chat/send function, enabling server-side request forgery (SSRF). The attack is network-based, requires no user interaction or privileges, and ...

CVE-2026-19000 JeecgBoot Anonymous Chat Attachment send server-side request forgery

A vulnerability was identified in JeecgBoot up to 3.9.2. The affected element is an unknown function of the file /airag/chat/send of the component Anonymous Chat Attachment Parser. The manipulation leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-71234

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stored valu...

CVE-2026-71234 Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stored valu...

CVE-2026-71234

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a secure query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stor...

CVE-2026-71234 Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stored valu...

EUVD-2026-53307

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a secure query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stor...

CVE-2026-71234

Documize Community exposes an authentication bypass in the attachment download endpoint: the Download function accepts a non-empty secure query parameter and grants access without validating against a server-stored value. This is inconsistent with sibling handlers (togglePublish, delete) which en...

CVE-2026-15281

The WordPress plugin User Access Manager (v

CVE-2026-15281 User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection

The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wpajaxsave-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentDa...

CVE-2026-13229

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint...

CVE-2026-13229

Affected product/versions: Zammad 7.1.0 (ticket article attachment cloning endpoint).Root cause: authenticated improper authorization in the endpoint, enabling actions beyond the intended permissions.Impact: confidentiality impact HIGH per CVSS metrics; exploitation could arise from network-acces...

EUVD-2026-52856

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint...

CVE-2026-13229 Zammad 7.0.1 - Improper authorization in ticket article attachment cloning

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint...

sg3_utils security, bug fix, and enhancement update

1.48-7.1 - sginq output conformance for SCSI name string and ATA fields RHEL-188123...

Improper Check for Unusual or Exceptional Conditions

Overview org.webjars.npm:socket.io-parser is a socket.io protocol parser Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via attachment handling. An attacker can cause the server to exhaust memory resources by sending specially crafted...

EUVD-2026-52410

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory...