CVE-2026-86347

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

CVE-2026-86347 MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

CVE-2026-86347

MISP is affected by a missing authorization flaw in the TemplatesController::uploadFile() action. The ACL entry for templates/uploadFile used the wildcard * instead of the intended perm_add role restriction, allowing any authenticated user—including low-privileged or read-only users—to repeatedly...

CVE-2026-86347 MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

CVE-2026-86347 MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

EUVD-2026-72322

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

CVE-2026-86347: Missing Authorization

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

PT-2026-86669

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

Exploit for Classic Buffer Overflow in Apple Macos

CVE-2026-64705 — HFS xattr kernel heap overflow macOS Root-...

CVE-2026-85092

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

EUVD-2026-70302

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-71224: Allocation of Resources Without Limits or Throttling

A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images...

D-Link DIR-825M Subroutine Code Execution

The vulnerability of the sub46725C function in the /boafrm/formDiskFormat file of the Disk Formatting Handler Endpoint component of the D-Link DIR-825M microprogramming router lies in the fact that the output of the operation is stored outside of the buffer in memory. Exploiting this vulnerabilit...

EUVD-2026-62534

Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits...

CVE-2026-84374

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy method resolves the caller-controlled $destination supplied through Excel::store, $export-store, or storeExcel against the process workin...

CVE-2026-84374 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy method resolves the caller-controlled $destination supplied through Excel::store, $export-store, or storeExcel against the process workin...

CVE-2026-84374

Laravel Excel (Maatwebsite) versions 3.1.8 through 3.1.70 contain a path-traversal flaw in Maatwebsite\Excel\Files\Disk::copy() (src/Files/Disk.php). The method resolves a caller-controlled $destination passed via Excel::store(), $export->store(), or storeExcel() against the process working di...

CVE-2026-84374 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy method resolves the caller-controlled $destination supplied through Excel::store, $export-store, or storeExcel against the process workin...

CVE-2026-84374: Improper Limitation of a Pathname to a Restricted Directory

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy method resolves the caller-controlled $destination supplied through Excel::store, $export-store, or storeExcel against the process workin...