CVE-2026-120204

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the outputdir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files ...

CVE-2026-120204 DeepInfer through 0.1.0 Path Traversal via /profile output_dir Parameter

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the outputdir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files ...

EUVD-2026-114725

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the outputdir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files ...

CVE-2026-61854

VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In reportbuffer.py, maybecleanup uses an unlocked dictionary for once-per-hour cleanup...

EUVD-2026-114280

VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In reportbuffer.py, maybecleanup uses an unlocked dictionary for once-per-hour cleanup...

CVE-2026-61854: jackh54 VoiceSentinel: VoiceSentinel is a real-time voice moderation system for Minecraft servers

VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In reportbuffer.py, maybecleanup uses an unlocked dictionary for once-per-hour cleanup...

CVE-2026-63190

FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn authentication checks, CSRF protection or adequate path validation. On PHP's built-in...

CVE-2026-63190 FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS

FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn authentication checks, CSRF protection or adequate path validation. On PHP's built-in...

EUVD-2026-112405

FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn authentication checks, CSRF protection or adequate path validation. On PHP's built-in...

CVE-2026-63190

FearlessCMS versions prior to 0.1.4 contain five unauthenticated debug/test PHP scripts under the admin/ directory. On PHP's built-in development server (including default Docker deployments), an authentication bypass exists because router.php fails to normalize URI prefixes, allowing /./admin/ t...

PT-2026-129163

FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn authentication checks, CSRF protection or adequate path validation. On PHP's built-in...

CVE-2026-63190: Missing Authentication for Critical Function

FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn authentication checks, CSRF protection or adequate path validation. On PHP's built-in...

CVE-2026-86018 Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment...

CVE-2026-86018 Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment...

CVE-2026-86018

The Part-DB inventory management system for electronic components is vulnerable to disk exhaustion in versions prior to 2.13.2 . The root cause is the "Download external file" attachment feature, which allows authenticated users to bypass the MAX_ATTACHMENT_FILE_SIZE limit. When server-side attac...

ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

Summary The form submission endpoint runs multer dest: os.tmpdir .any before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is receive...

GHSA-89MH-MM8C-MV7F ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

Summary The form submission endpoint runs multer dest: os.tmpdir .any before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is receive...

EUVD-2026-105188

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it...

CVE-2026-113656 ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated...

CVE-2026-113656 ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated...