PhotoPrism global preview/download tokens bypass resource visibility boundaries

PhotoPrism global preview/download tokens bypass resource visibility boundaries Vulnerability Overview PhotoPrism loads thumbnails and file downloads via simple URLs that cannot carry authentication headers preview/download tokens in query parameters or paths, validated by an in-memory token look...

PhotoPrism Vision API can read server-local files

PhotoPrism Vision API can read server-local files Vulnerability Overview PhotoPrism's computer vision features caption, labels, nsfw, face assemble image references into outbound requests to the configured vision model through a set of request builders. Image references come from two sources: loc...

PhotoPrism WebDAV Sync path traversal allows writing to arbitrary paths

PhotoPrism WebDAV Sync path traversal allows writing to arbitrary paths Vulnerability Overview PhotoPrism supports WebDAV sync: after an administrator configures a WebDAV remote, a background worker pulls the remote directory listing and downloads files to the local sync directory. The local...

Seafile out-of-bounds read on malformed head commit ID

Seafile out-of-bounds read on malformed head commit ID Vulnerability Overview When the Seafile client daemon checks the remote head commit, it parses the head commit ID from the server response and copies it into the destination buffer at a fixed length 40 bytes; Seafile commit IDs are 40...

Seafile server-controlled sync path can escape the client worktree (macOS/Linux)

Seafile server-controlled sync path can escape the client worktree macOS/Linux Vulnerability Overview The Seafile client's sync module applies file diffs delivered by the server during the checkout phase, and the target path of rename operations is fully controlled by the server. The validity che...

Portainer Edge Agent endpoints do not validate EdgeStack assignment, allowing unauthorized reads of unassigned stack files and forged status reports

Portainer Edge Agent Endpoint EdgeStack Assignment Authorization Bypass Vulnerability Overview Two categories of Portainer Server endpoints serving Edge Agents -- Edge Stack deployment-file retrieval and deployment status reporting -- resolve the reporting environment from the Edge ID in the...

NocoDB leaks other creators' private integration configuration when includeConfig is omitted

NocoDB Private Integration Configuration Information Disclosure Vulnerability Overview NocoDB's workspace-level Base Integration read service has an authorization logic flaw in its handling of the includeConfig request parameter: the check that "a private integration's configuration is visible on...

WeKan expired impersonation records bypass private board export authorization (ImpersonateBleed)

WeKan Expired Impersonation Records Bypass Private Board Export Authorization ImpersonateBleed Vulnerability Overview WeKan administrators can use the impersonation feature to operate as other users, and the system records every impersonation action. The flaw is this: in addition to the normal...

NocoDB dtxp field DDL constraint injection (CHECK/REFERENCES injection; fixed via strict precision allowlist)

NocoDB Data-Type Precision Field DDL Constraint Injection Vulnerability Overview When generating DDL statements such as table creation and column addition, NocoDB concatenates the user-provided data-type precision field dtxp into the column definition, applying only limited processing without...

WeKan /metrics unconditionally trusts X-Forwarded-For, allowing whitelist IP spoofing (MetricsBleed)

WeKan /metrics Unconditionally Trusts X-Forwarded-For, Allowing Whitelist IP Spoofing MetricsBleed Vulnerability Overview WeKan's Prometheus /metrics endpoint restricts access via an IP whitelist only configured monitoring IPs are allowed. When determining the client's source IP, the code...

WeKan Trello import source.url stored XSS can steal Meteor.loginToken (SourceBleed)

WeKan Trello Import source.url Stored XSS Can Steal Session Tokens SourceBleed Vulnerability Overview When WeKan imports a Trello board, it persists the import source information including the source board's URL and renders it as a clickable link in the board's activity sidebar, without validatin...

WeKan Avatar Localization follows redirects, bypassing SSRF protections (RedirectBleed)

WeKan Avatar Localization Follows Redirects, Bypassing SSRF Protections RedirectBleed Vulnerability Overview WeKan allows users to set an external avatar URL in their profile, and the server-side avatar localization feature fetches that URL and caches the avatar as a local attachment. Although SS...

WeKan Trello Live Import attachment download lacks SSRF validation, allowing readable-response SSRF (LiveBleed)

WeKan Trello Live Import Attachment Download Lacks SSRF Validation, Allowing Readable-Response SSRF LiveBleed Vulnerability Overview WeKan supports two ways to import Trello boards: offline import and Live Import online API key mode. Download URLs on the offline import path all go through unified...

WeKan OIDC login callback shares serviceData/profile, enabling concurrent account takeover (regression hardening)

WeKan OIDC Login Callback Shares Login Context, Enabling Concurrent Account Takeover Regression Hardening Vulnerability Overview In WeKan's OIDC OAuth2/OIDC login flow, the per-login identity context objects were once placed in a shared scope outside the login callback, so multiple concurrent OID...

WeKan CAS login shares module-level global user data, enabling concurrent account takeover (CasBleed)

WeKan CAS Login Shares Module-Level Global User Data, Enabling Concurrent Account Takeover CasBleed Vulnerability Overview WeKan's CAS single sign-on implementation contains a concurrent race condition flaw: the user identity data returned by the CAS server after ticket validation is stored in a...

GStreamer DTLS plugin openssl_verify_callback stack buffer overflow on certificate subject DN causes remote denial of service

GStreamer DTLS Plugin Stack Buffer Overflow in Certificate Subject DN Handling Causes Remote Denial of Service CVE-2026-59692 Vulnerability Overview In the GStreamer DTLS plugin the dtls element of gst-plugins-bad, used for the DTLS channel in WebRTC pipelines, the peer certificate verification...

VMware Workstation/Fusion NAT vulnerability: a guest VM admin can disrupt or intercept other guest VMs' network connections

VMware Workstation/Fusion NAT Network Packet Management Flaw Allows a Guest VM to Disrupt or Intercept Other Guest VMs' Network Connections CVE-2026-22715 Vulnerability Overview VMware Workstation and Fusion contain a logic flaw CWE-923, communication channel not correctly restricted to intended...

Security Bulletin: TSSC/IMC addresses multiple security vulnerabilities.

Summary TSSC/IMC addresses multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2026-22007 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE...

CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-14456

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...