CVE-2026-48211

The OTRS software is vulnerable to a Cross-Site Request Forgery (CSRF) attack in its Import/Export Admin console. The root cause is that the AdminImportExport::TemplateDelete action fails to validate the request's ChallengeToken . This allows an unauthenticated remote attacker to trick an authent...

CVE-2026-21127

Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data...

CVE-2026-21127

The Samsung Account application, on versions prior to 15.7.01.1 , is vulnerable to an improper export of android application components . This flaw allows local attackers to gain unauthorized access to sensitive data . No specific exploit information or mitigation steps are provided in the docume...

EUVD-2026-97191

Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data...

CVE-2026-109202: Missing Authorization

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since...

CVE-2026-93581: Improper Neutralization of Formula Elements in a CSV File

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV...

PT-2026-110492

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.X through 2026.6.X OTRS Community Edition versions 6.x and earlier Description User-controlled values are not sufficiently neutralized when included in CSV exports. Data submitted by authenticated users or received via extern...

EulerOS 2.0 SP11 : nfs-utils (EulerOS-SA-2026-4347)

According to the versions of the nfs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the...

PT-2026-110710

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.11.0 through 0.11.3 Description Authenticated non-admin users with tool export permission can obtain the full Python source code of tools shared with them in read-only mode. This occurs when requesting the 'GET...

CVE-2026-109293: Exposure of Sensitive Information to an Unauthorized Actor

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of...

EulerOS 2.0 SP11 : nfs-utils (EulerOS-SA-2026-4257)

According to the versions of the nfs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the...

PT-2026-110485

Name of the Vulnerable Software and Affected Versions OTRS versions 6.x and earlier OTRS versions 7.0.x through 2026.6.x Description An authenticated administrator can be induced to delete administrative Import/Export templates via a Cross-Site Request Forgery CSRF attack. This occurs because the...

CVE-2026-48211: Cross-Site Request Forgery (CSRF)

An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery CSRF attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a...

Malicious code in crypto-tax-export (RubyGems)

Source: amazon-inspector d2481974cbcc361b29455129afea878124dafde18097efca0a87235df57f3bea The gem's native-extension build script ext/cryptotaxexport/extconf.rb runs during gem install. Before executing its payload it performs sandbox/analysis-evasion checks CI environment variables,...

CVE-2026-108887

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every syscomment row, including comment text and...

CVE-2026-108888 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys/sysDepartRole/exportXls to download a...

creepy

creepy Versión actual 1.1 Autor Yiannis Kakavas Página principal http://www.geocreepy.com Instrucciones de instalación Consulte http://www.geocreepy.com Descripción Herramienta OSINT de geolocalización. Creepy es una herramienta OSINT de geolocalización. Recopila información relacionada con la...

MAL-2026-17782 Malicious code in crypto-tax-export (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2481974cbcc361b29455129afea878124dafde18097efca0a87235df57f3bea The gem's native-extension build script ext/cryptotaxexport/extconf.rb runs during gem install. Before executing its payload it performs...

CVE-2026-108745

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims...

CVE-2026-108745 CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims...