40859 matches found
MINI-F6P5-PM4F-XGXP
Bulletin has no description...
MINI-X2FW-P82Q-V99H
Bulletin has no description...
MINI-MFXQ-6FPJ-7GH7
Bulletin has no description...
EUVD-2026-4492
gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting CVE-2026-0755...
CVE-2026-48716 nanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file write
nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge in bridge/src/whatsapp.ts constructs a filesystem path using the fileName field from an incoming WhatsApp document message without sanitization. The WhatsApp bridge downloads media attachments and writes th...
CGA-4MWV-6XRJ-9CG9
Bulletin has no description...
GHSA-JR45-52CW-69H5 NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)
Summary A previous advisory CVE-2026-49463 / GHSA-qpm9-h556-mwxm reported that any logged-in user could download any document by its identifier, and stated this was fixed in 3.0.1. For the document-content part that fix was incomplete: documents remained downloadable by any authenticated user in...
NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)
Summary A previous advisory CVE-2026-49463 / GHSA-qpm9-h556-mwxm reported that any logged-in user could download any document by its identifier, and stated this was fixed in 3.0.1. For the document-content part that fix was incomplete: documents remained downloadable by any authenticated user in...
MINI-2R3G-QFJ3-33RJ
Bulletin has no description...
CVE-2026-8811
SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory, potentially placing files in web-accessible locations...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the document conversion process. An attacker can cause the server to make arbitrary outbound HTTPS requests or access local image files by uploading a specially crafted DOCX document that references...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the document conversion process. An attacker can cause the server to make arbitrary outbound HTTPS requests or access local image files by uploading a specially crafted DOCX document that references...
Gotenberg: SSRF via LibreOffice document processing
Summary Server-Side Request Forgery SSRF vulnerability affecting the /forms/libreoffice/convert endpoint in Gotenberg v8.33.0 running with the default configuration. By uploading a specially crafted DOCX document, an attacker can cause LibreOffice to automatically retrieve external resources duri...
CGA-RVF4-4826-WXM7
Bulletin has no description...
MINI-MH9G-P9WF-QPM4
Bulletin has no description...
MINI-6JGR-JX8X-WFG7
Bulletin has no description...
EUVD-2026-37866
SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory, potentially placing files in web-accessible locations...
CVE-2026-8811 Path traversal in PDF generation module
SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory, potentially placing files in web-accessible locations...
CVE-2026-8811
CVE-2026-8811 affects SEPPmail versions before 15.0.5, in the PDF generation module. Improper handling of attachment filenames during encrypted PDF creation allows path traversal, enabling an attacker to create files outside the intended directory and potentially place them in web‑accessible loca...
