37315 matches found
EUVD-2026-42853
R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user...
CVE-2026-41877 Stored XSS in R-SOFT DMS
R-SOFT DMS is vulnerable to Stored XSS in file upload functionality. Authenticated attacker can inject arbitrary HTML and JS into the name of the file being uploaded, which will be executed when visiting file list or upload status by other users. This issue was fixed in version v3.19-2832 and...
CVE-2026-59935
A flaw was found in pypdf, a pure-python PDF library. A remote attacker can craft a malicious PDF file containing an unterminated inline image within the page content stream. When this crafted PDF is parsed, it can lead to an infinite loop, resulting in a denial of service DoS due to resource...
MINI-9Q87-3JCM-HJ7F
Bulletin has no description...
MINI-4HR8-C2M5-6945
Bulletin has no description...
MINI-426R-7WCC-3HM7
Bulletin has no description...
WordPress Document Gallery plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin Document Gallery versions = 5.1.0...
js-yaml: js-yaml: Denial of Service via crafted YAML documents
A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...
MINI-4HRW-6489-PF86
Bulletin has no description...
CVE-2026-59853
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without the publish-access filtering used by sibling storage endpoints, allowing a publish-mode Reader to read private...
CVE-2026-59832
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticat...
CVE-2026-59832
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticat...
MINI-RR34-7V2J-V4X8
Bulletin has no description...
MINI-8R85-P5PX-PGRG
Bulletin has no description...
CGA-J986-W997-4353
Bulletin has no description...
MINI-WJWV-57R7-5RGH
Bulletin has no description...
MINI-67FM-29PH-WCCX
Bulletin has no description...
MINI-MJ6Q-9GHH-CMWV
Bulletin has no description...