EUVD-2026-60553

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint...

PT-2026-77191

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 3.0.0 through 5.4.7 Joomla! Core versions 6.0.0 through 6.1.2 Description Lack of output processing in multiple download views allows for response header injection. This issue can lead to reflected file download or...

PT-2026-77112

Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...

CVE-2026-73181: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

CVE-2026-73383: Improper Limitation of a Pathname to a Restricted Directory

Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...

CVE-2026-52734: Missing Release of Memory after Effective Lifetime

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated P2P peer can cause the mempool download pipeline to retain transactions after verification reaches the outer RATELIMITDELAY timeout. In zebrad/src/components/mempool/downloads.rs, Downloads::pollnext removed...

CVE-2026-52732: Allocation of Resources Without Limits or Throttling

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAXINBOUNDCONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally withou...

CVE-2026-71572: Improper Neutralization of CRLF Sequences

Joomla! Core - 20260801 - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion...

PT-2026-77080

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

PT-2026-80377

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx in github.com/patrickhener/goshs...

Typemill 2.25.0 Authorization Bypass

Typemill version 2.25.0 and below contains an authorization bypass vulnerability in role-restricted media downloads. The application performs its authorization check using the raw request path while accessing the file using the filesystem-resolved path. An unauthenticated remote attacker can use...

Exploit for CVE-2026-71518

CVE-2026-71518 — Typemill Unauthenticated Authorization Bypass...

CVE-2026-67918

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint...

CVE-2026-75529

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download//.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...

CVE-2026-71518

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

EUVD-2026-60470

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-71518

Typemill before 2.26.0 has an authorization bypass in the media file download route: the restriction check keys on the raw, un-normalized request path ($restrictions['media/files/' . $args['params']]) while file_get_contents($base . $params) resolves via the OS-normalized path. Since validate() o...

CVE-2026-71518 Typemill < 2.26.0 Authorization Bypass via Media File Download Route

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-71518 Typemill < 2.26.0 Authorization Bypass via Media File Download Route

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-71518 Typemill < 2.26.0 Authorization Bypass via Media File Download Route

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...