CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

CVE-2026-101046 Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/id/activities. The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL...

EUVD-2026-87977

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/id/activities. The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL...

CVE-2026-101046

Fleet versions prior to 4.89.0 are vulnerable to an SQL injection in the activity list endpoints: GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities. The root cause is the deprecated cursor-pagination helper appendListOptionsWithCursorToSQL, which interpolates caller-supplie...

CVE-2026-101046 Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/id/activities. The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL...

CVE-2026-101033

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation...

CVE-2026-101033

The KitchenOwl application (versions through 0.7.10 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists because the application fails to verify if provided category IDs belong to the caller's household during expense and item operations. This allows authenticated attac...

EUVD-2026-87946

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation...

CVE-2026-97164

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

EUVD-2026-87931

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

CVE-2026-97164

The Event Gallery extension for Joomla (developed by svenbluege.de ) versions

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Craftcms Craft_Cms

CVE-2026-28695 patch bypass — Craft CMS ≤ 5.9.8 authenticated RC...

CVE-2026-82841

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...

EUVD-2026-87887

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the process.run function during Liquidsoap configuration generation for live recording. An attacker can execute arbitrary system commands by supplying a specially crafted streamer username containing shell...

CVE-2026-100861

heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service...

CVE-2026-100855

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...

CVE-2026-100836

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a...