CVE-2026-14568

CVE-2026-14568 affects the WordPress plugin “User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration” (before 4.3.8). The vulnerability arises because the plugin does not correctly verify ownership before deleting an attachment, enabling un...

CVE-2026-14568

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments su...

EUVD-2026-49082

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments su...

CVE-2026-65708

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

CVE-2026-65708 sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

CVE-2026-65708 sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

EUVD-2026-48714

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

CVE-2026-65708

CVE-2026-65708 affects sysPass version 3.2.11. An insecure direct object reference in the AccountFileController lets any authenticated attacker access account file attachments they lack ACL permissions for by supplying arbitrary numeric file IDs in actions such as download, view, delete, upload, ...

PT-2026-64375

Name of the Vulnerable Software and Affected Versions sysPass version 3.2.11 Description An insecure direct object reference occurs due to missing authorization checks in the AccountFileController. This allows an authenticated attacker to access account file attachments for which they lack Access...

GO-2026-6035 Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content in gitea.dev

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content in gitea.dev...

GO-2026-6028 Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) in gitea.dev

Gitea: Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939 in gitea.dev...

EUVD-2026-47455

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite component: Attachments. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2026-46515

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite component: Attachments. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-47028

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite component: Attachments. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-46403

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

CVE-2026-56147

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or...

GHSA-6C6R-5XR4-CR5M Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or...

GHSA-Q9PG-JJ6X-J9P6 Gitea: draft release attachment disclosure via missing web authorization

Summary Gitea's draft-release access control is enforced only on the API release endpoints /api/v1/repos/owner/repo/releases/id and its /assets/... sub-routes but not on the web-level UUID-based attachment endpoints /attachments/uuid, /owner/repo/attachments/uuid,...