CVE-2026-61843

Versions of FileRise prior to 3.18.0 are vulnerable to an unauthenticated file overwrite. The software fails to reject destination filenames that already exist within upload-enabled shared folders or upload-only links. An unauthenticated visitor with a valid share token and password can upload a ...

CVE-2026-61843 FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and an...

CVE-2026-61843 FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and an...

CVE-2026-54703

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that...

CVE-2026-102986

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

CVE-2026-55498 FileRise Shared Folder Symlink Escape

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An...

CVE-2026-102986

The open-source project management tool Plane (versions 1.3.1 and earlier) contains an authorization bypass in the EntityAssetEndpoint at the /api/public/assets/v2/anchor/{anchor}/ endpoint. While the endpoint requires authentication for write operations, it fails to verify workspace or project m...

EUVD-2026-101614

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

CVE-2026-102986 Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

CVE-2026-102986 Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

CVE-2026-85714

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...

CVE-2026-110774

Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp...

CVE-2026-110775

Nexent through 2.7.0 contains a missing authorization vulnerability in checkfileaccess that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledgebase/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage f...

CVE-2026-110666

A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the file sar2html.py of the component File Upload. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue...

CVE-2026-100406

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...

CVE-2026-54702

The Markdown Preview Enhanced extension for Visual Studio Code is vulnerable to Blind Command Dispatch in versions prior to 0.8.30 . The webview message handler in src/preview-provider.ts fails to perform allowlist or type validation on attacker-controlled command values and arguments within the ...

CVE-2026-54702 Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

EUVD-2026-101585

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

CVE-2026-54702 Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

CVE-2026-54703

The Markdown Preview Enhanced extension for Visual Studio Code is vulnerable to an arbitrary file write in versions prior to 0.8.30 . The root cause is that the _crossnote.updateMarkdown command accepts an arbitrary URI and attacker-controlled content, passing them to vscode.workspace.fs.writeFil...