PT-2026-96939

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in...

CVE-2026-76194: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue requires user...

PT-2026-96655

Name of the Vulnerable Software and Affected Versions BM Content Builder versions prior to 3.17.1 Description Insufficient file path validation in the ux cb remove layout ajax and ux cb tools export ajax functions allows authenticated attackers with Subscriber-level access and above to delete...

CVE-2026-88415

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting XSS. The article content field contentDetails is excluded from the global XSS filter...

CVE-2026-75638: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in...

CVE-2026-75632: Uncontrolled Resource Consumption

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue...

CVE-2026-89277: Integer Overflow or Wraparound

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user...

EUVD-2026-84857

CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection into a no-op on every state-changing admin request, and it does not send the csrftoken hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an...

PT-2026-96659

Name of the Vulnerable Software and Affected Versions Custom Field Template versions prior to 2.7.9 Description The plugin contains an Insecure Direct Object Reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue exists in t...

APSB26-147 : Security updates available for Content Credentials SDK

Adobe has released a security update for Content Credentials SDK. This update addresses critical and important vulnerabilities that could result in security feature bypass and application denial-of-service. Adobe is not aware of any exploits in the wild for any of the issues addressed in this...

CVE-2026-59815

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. ...

CVE-2026-61541

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-59814

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61541

Zapros , a Python HTTP client, is vulnerable to denial of service in versions prior to 0.14.0 . The root cause is an unbounded chained Content-Encoding decompression chain : when an application requests content from an untrusted server (or follows a redirect to one), a malicious response containi...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-55179

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking...

CVE-2026-59815 Joplin: Pending share recipients can write items into shared folders before accepting invitations

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. ...

CVE-2026-59814 Joplin: Stored XSS via inline-served note attachment on published shares

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A...