CVE-2026-48070 Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can...

CVE-2026-77293 TREK: Cross-user note-file deletion (IDOR / Broken Access Control)

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and...

CVE-2026-77293

The collaborative travel planner TREK is vulnerable to an Insecure Direct Object Reference (IDOR) or Broken Access Control issue in versions prior to 3.3.0 . The DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint fails to properly verify if the target note-file belongs to the a...

EUVD-2026-86341

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and...

CVE-2026-77293 TREK: Cross-user note-file deletion (IDOR / Broken Access Control)

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and...

CVE-2026-77293 TREK: Cross-user note-file deletion (IDOR / Broken Access Control)

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and...

CVE-2026-84302

The open-source discussion platform Discourse is vulnerable in versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 . The root cause is that reviewable visibility filtering fails to restrict Discourse AI reviewables associated with private messages. This allows moderators who are not part...

Malicious code in cache-swipper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50cb98e5f107fe5bd1cd9434505219880014742674def9c64a8ce8552e04a626 cache-swipper advertises itself as a safe cache and build-artifact cleanup utility, but the exported runOperation function performs an unbounded...

MAL-2026-17166 Malicious code in cache-swipper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50cb98e5f107fe5bd1cd9434505219880014742674def9c64a8ce8552e04a626 cache-swipper advertises itself as a safe cache and build-artifact cleanup utility, but the exported runOperation function performs an unbounded...

CVE-2026-3253 MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

CVE-2026-3253

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data in versions up to and including 1.7.21 . The root cause is a missing capability check on the forms() method of the AdminController class. This vulnerability allows authenticated attack...

WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by Matheo Beuve in WordPress Plugin Customer Reviews for WooCommerce versions = 5.120.0...

WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Template Kit – Import versions = 1.0.16...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin 3.1.0-8.9.4 - Subscriber+ Arbitrary Listing Deletion vulnerability

Subscriber+ Arbitrary Listing Deletion vulnerability discovered by Artus KG in WordPress Plugin Directorist versions 3.1.0-8.9.4...

CVE-2026-97056

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

CVE-2026-97056 SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

PT-2026-98223

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.3.0 Description An authorization flaw exists in the collaborative travel planner where the endpoint "DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId" fails to verify if the file belongs to the specified...

LLM Agents Can Easily Tamper with Their Own Traces

Asynchronous monitoring, incident investigations, and compliance audits primarily rely on agent traces to reconstruct what happened. These analyses assume that LLM agents cannot tamper with their own execution traces. We show that local LLM agents such as Claude Code, Codex, Antigravity, Open Cod...

CVE-2026-77293: Authorization Bypass Through User-Controlled Key

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and...

CVE-2026-48070: Improper Limitation of a Pathname to a Restricted Directory

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can...