CVE-2026-124431

Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all...

EUVD-2026-119569

Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all...

PT-2026-139947

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.10.0 through 5.11.1 Description An authorization bypass allows authenticated users with low privileges to browse volumes for which they lack permissions. By deleting a linked asset and utilizing the replacement volume...

CVE-2026-124431: craftcms cms: Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated…

Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all...

CVE-2026-113369

Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository a user account that holds the edit permission on that repository to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the...

EUVD-2026-117062

Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository a user account that holds the edit permission on that repository to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the...

CVE-2026-113369 Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab

Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository a user account that holds the edit permission on that repository to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the...

CVE-2026-109118 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb

Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...

CVE-2026-109118 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb

Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...

CVE-2026-109118

The ikus060 rdiffweb 7.1.1 software contains a Path Traversal vulnerability (CWE-22) due to an improper path containment check. An authenticated user can use a percent-encoded traversal sequence (%2e%2e) in the request path to cause browse, restore, history, and delete operations to resolve to pa...

CVE-2026-97667

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...

CVE-2026-97665 Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload

A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages .snupkg to a hosted repository, bypassing the write-permission check enforced for ordinary packag...

CVE-2026-97667

Sonatype Nexus Repository 3 is vulnerable to Stored Cross-Site Scripting (XSS) in its Browse UI. An account with edit permissions on a hosted R repository can inject script content into the metadata of an uploaded R package. When another user views the package details in the Browse UI, the script...

EUVD-2026-102154

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...

CVE-2026-97667 Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...

CVE-2026-97667 Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...

PT-2026-115007

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...

CVE-2026-97667: Improper Neutralization of Input During Web Page Generation

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...

CVE-2026-108523

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repourl can lead to server-side request forgery. The attack may be...

CVE-2026-108523 Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repourl can lead to server-side request forgery. The attack may be...