12261 matches found
CVE-2026-50553: Improper Input Validation
Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...
Lutece Core 7.1.7 Remote Code Execution
Lutece Core versions 7.1.7 and below suffer from an authenticated remote code execution vulnerability via XSLT injection. https://packetstorm.news/download/230543...
Linux Distros Unpatched Vulnerability : CVE-2026-76060
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitiz...
Applications Restored by Veeam Kasten Disaster Recovery Fail to Export with: invalid repository password
Challenge After a Veeam Kasten Disaster Recovery KDR restore is performed on an instance of Veeam Kasten for Kubernetes running a version earlier than 8.5.4, and that instance is later upgraded to version 8.5.4 or newer, export and backup actions for the restored applications fail with an error...
SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)
Summary SiYuan's /export/ file handler was hardened against export disclosure issue 12213 by adding an IsSubPathexportBaseDir, fullPath check and an IsSensitivePath check in commit bb481e1. These guards were added only to the main branch of the handler. The handler begins with a short-circuit...
GHSA-GW25-M53R-QH88 SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)
Summary SiYuan's /export/ file handler was hardened against export disclosure issue 12213 by adding an IsSubPathexportBaseDir, fullPath check and an IsSensitivePath check in commit bb481e1. These guards were added only to the main branch of the handler. The handler begins with a short-circuit...
CVE-2026-9852
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue...
CVE-2026-9852: Improper Neutralization of Formula Elements in a CSV File
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue...
EUVD-2026-70261
UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a...
CVE-2026-75136 UpSignOn < 7.19.0 Biometric Key Exposure via Windows PasswordVault
UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a...
CVE-2025-15481
The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
Summary The @apostrophecms/import-export module reconstructs the on-disk source path of every imported attachment from JSON metadata contained in the uploaded archive. The archive carries an aposAttachments.json file whose name and extension fields are concatenated into a filesystem path with no...
GHSA-79QF-VQGC-7XX3 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
Summary The @apostrophecms/import-export module reconstructs the on-disk source path of every imported attachment from JSON metadata contained in the uploaded archive. The archive carries an aposAttachments.json file whose name and extension fields are concatenated into a filesystem path with no...
EUVD-2026-60441
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal...
CVE-2025-15481 Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure
The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...
EUVD-2025-210829
The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...
CVE-2025-15481 Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure
The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...
CVE-2025-15481
The Notification Bar for WordPress plugin (slug 8-degree-notification-bar) through version 1.1.8 exposes an unauthenticated CSV export script at inc/backend/blocks/export-csv.php, allowing anyone to download all stored subscriber email addresses without authentication. The vulnerability is rated ...
Malicious Package
Overview array-async-export-lambda-transpile is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...
CVE-2025-15481: Missing Authentication for Critical Function
The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...