72 matches found
CVE-2026-46691 EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...
CVE-2026-46691
The open-source CRM EspoCRM contains an Insecure Direct Object Reference (IDOR) vulnerability in the POST /api/v1/Import/{id}/exportErrors endpoint in versions prior to 9.3.7 . While the endpoint performs a scope-level check, it fails to perform the entity-level ownership check required by the Im...
CVE-2026-46691 EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...
CVE-2026-46691 EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...
SUSE CVE-2026-63267
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...
DEBIAN-CVE-2026-63267
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...
UBUNTU-CVE-2026-63267
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...
CVE-2026-63267
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...
CVE-2026-63270 Environment/ini-file leaks
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...
EUVD-2026-92421
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...
CVE-2026-63267
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...
CVE-2026-63267: Server-Side Request Forgery (SSRF)
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...
Linux Distros Unpatched Vulnerability : CVE-2026-63267
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded,...
PT-2026-104814
Name of the Vulnerable Software and Affected Versions LibreOffice Calc affected versions not specified Description LibreOffice Calc allows linking a cell range to an external csv data source, with the link being saved within the document. Because these links are fetched during the document loadin...
PT-2026-95979
Name of the Vulnerable Software and Affected Versions 00Kisumi00 mcp-file-analyzer versions up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 Description A path traversal issue exists in the analyze csv data MCP tool within the ControlFlowNode function of the main.py file. This occurs when the...
CVE-2026-78136
chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...
CVE-2026-78136
chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...
CVE-2026-78136
chirpmyradio CHIRP (a radio programming tool) is vulnerable to eval injection via crafted CSV data in the _clean_tmode function within drivers/kenwood_itm.py. This flaw allows arbitrary code execution when a user opens a maliciously crafted CSV file, as indicated by the associated research reposi...