EUVD-2026-42272

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope...

GHSA-X756-G4X3-C64M Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses

Summary Cloudreve's remote download workflow accepts user-supplied URLs and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets. When the remote download permission is granted to a non-admin user group, a normal...

CVE-2026-44229

CVE-2026-44229 (RT) affects the Request Tracker project: versions 5.0.0 and 6.0.0 and above, up to but not including 5.0.10 and 6.0.3, contain an XSS vulnerability where uploaded content is served inline instead of as an attachment. An authenticated user who can upload content can inject JavaScri...

EUVD-2026-46053

The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG...

CVE-2026-60028

The CVE-2026-60028 entry concerns the Joomla extension Quix Page Builder Pro, vulnerable to an authenticated stored XSS due to unescaped output and unsanitised SVG. The issue affects Quix Page Builder Pro (prior to version 6.2.1) where an authenticated builder user can inject scripts that execute...

CVE-2026-44228

RT: Stored Cross-Site Scripting in versions 6.0.0–6.0.2 due to insufficient HTML escaping; an authenticated user with data‑setting permissions can inject JavaScript executed by other RT users. Fixed in 6.0.3. Affected product details, root cause, and fix are documented across CVE and NVD entries;...

CVE-2026-32824

The CVE affects dataCycle-CORE (dataCycle data management system). Before and including version 25.07.3, a low-privileged authenticated API user could supply forwardToUrl and redirectUrl during password reset/confirmation flows, which were embedded into outgoing emails without host allowlisting. ...

CVE-2026-54910

FileBrowser Quantum is vulnerable to a path traversal flaw in the subtitlesHandler endpoint (GET /api/media/subtitles) prior to v1.4.3-beta. The vulnerability arises from two user-controlled parameters, path and name, used in filesystem operations without sanitization. The path parameter is passe...

CVE-2026-63734

SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other...

CVE-2026-63758

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscription...

CVE-2026-63755

CVE-2026-63755 affects SurrealDB prior to 3.1.0. The bug evaluates user-supplied WHERE clauses (and related clauses in UPDATE/UPSERT/INSERT/RELATE) against full record data before applying table-level permissions, allowing an authenticated user to read full contents of any table in the current da...

CVE-2026-63754

SurrealDB before 3.1.0 is affected. A denial-of-service arises when malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only SELECT permission can block writes for any user (incl...

EUVD-2026-45925

SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write...

CVE-2026-63734

SurrealDB prior to 3.2.0 is affected by a denial-of-service vulnerability in the SurrealML header parser. Authenticated Owner‑role users can crash the server by uploading a malformed .surml file to the /ml/import endpoint. Malformed header fields (e.g., non-numeric input-dimensions) trigger unche...

Musicbox WordPress - Reflected XSS

contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13327 info:...

GestioIP - Reflected Cross-Site Scripting

GestioIP v3.5.7 contains a reflected cross-site scripting caused by unsanitized input in the ipdojob request, letting attackers execute scripts in the victim's browser, exploit requires specific user permissions. id: CVE-2024-50857 info: name: GestioIP - Reflected Cross-Site Scripting author:...

iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting

iBuildApp WordPress plugin through 0.2.0 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13326 info:...

ECT Home Page Products - Reflected XSS

ECT Home Page Products WordPress plugin through 1.9 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit...

WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion

The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete...

PT-2026-61571

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An...