CLSA-2026-1792457916 TuxCare security update for @babel/plugin-syntax-export-default-from (2 CVEs)

TuxCare rebuilt @babel/plugin-syntax-export-default-from to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792457909 TuxCare security update for @babel/plugin-syntax-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-syntax-export-default-from to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792457908 TuxCare security update for @babel/plugin-syntax-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-syntax-export-default-from to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

PT-2026-118451

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description An authenticated importer can submit archives where decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization. Additionally,...

PT-2026-118589

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 import-export module versions prior to 3.7.0 Description Import routes invoke bigUploadMiddleware without an early authorize callback. This allows unauthenticated requests to perform upload initialization...

PT-2026-118494

Name of the Vulnerable Software and Affected Versions import-export versions prior to 3.7.1 ApostropheCMS versions prior to 4.34.0 Description An editor with permissions to import an enabled content type, but lacking the required publication role, can bypass normal publish permissions and lifecyc...

PT-2026-118449

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description Predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires o...

PT-2026-118492

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description The API endpoint 'POST /api/v1/@apostrophecms/import-export/clean-export' lacks authentication and authorization checks. This allows unauthenticated anonymous users with a...

PT-2026-118345

A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approac...

PT-2026-118452

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description The import-export module allows duplicate-import continuation to accept replacement choices controlled by the client without binding them to a server-side analysis or...

FreakVulnChecker

FreakVulnChecker This script check if your list of server is accepting Export cipher suites and could be vulnerable to CVE-2015-0204 Usage Usage: ./freak.vuln.check.sh The program accept single ip:port or domain syntax or a list of ips or domains. It will output if the Exports cipher available in...

PT-2026-117495

Name of the Vulnerable Software and Affected Versions Eptura Archibus versions prior to 2025.02 Description An unauthenticated arbitrary file upload issue allows attackers to upload files with any content, including JSP and JSPX scripts, via the export reports feature. Because these uploaded file...

CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

CVE-2026-112014

The software LobsterAI prior to version 2026.10.16 contains a hardcoded password vulnerability (CWE-321). This flaw allows an attacker who obtains an exported provider file to decrypt third-party AI provider API keys. The vulnerability stems from using the constant 'lobsterai-APP' to encrypt keys...

CVE-2026-110268

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...

EUVD-2026-103219

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...

CVE-2026-110268 Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...

CVE-2026-110268 Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...

CVE-2026-110268

The Post Export Import with Media plugin for WordPress is vulnerable to a Directory Traversal (CWE-22) vulnerability in all versions up to and including 1.17.2 . The flaw exists in the 'theme_slug' parameter, allowing authenticated attackers with administrator-level access or higher to access or ...