CVE-2026-55876 Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and...

CVE-2026-55876 Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and...

CVE-2026-55876

The Helium student planner (prior to version 2.2.60 ) is vulnerable to Stored XSS via the POST /planner/attachments/ endpoint. The root cause is that conf/configs/common.py fails to include SVG and HTML formats in the BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES lists, which th...

WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion vulnerability

Authenticated Sales Representative+ Arbitrary File Deletion vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Groundhogg versions = 4.9.3...

CVE-2026-62679

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...

CVE-2026-102631

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...

EUVD-2026-102208

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copybanner in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets...

CVE-2026-61702 OpenPrinting CUPS: root-side banner file disclosure

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copybanner in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets...

CVE-2026-61702 OpenPrinting CUPS: root-side banner file disclosure

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copybanner in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets...

CVE-2026-61702

The OpenPrinting CUPS system (prior to version 2.4.20 ) is vulnerable to a root-side banner file disclosure due to a path traversal flaw in scheduler/ipp.c. The copy_banner() function fails to properly sanitize the attacker-controlled IPP attributes-natural-language value used as a directory comp...

CVE-2026-55480 CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/.ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...

CVE-2026-55480

OpenPrinting CUPS versions prior to 2.4.20 are vulnerable to a symlink TOCTOU (Time-of-Check to Time-of-Use) attack due to the copy_model() function in scheduler/ipp.c . The root cause is the creation of a predictable PPD tempfile path in an lp-group-writable directory without using O_EXCL or O_N...

CVE-2026-55480

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/.ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...

CVE-2026-55480 CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/.ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...

CVE-2026-55480

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/.ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...

EUVD-2026-102205

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/.ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...

WordPress Debloat – Remove Unused CSS, Optimize JS plugin <= 1.3.0 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Kuba in WordPress Plugin Debloat – Remove Unused CSS, Optimize JS versions = 1.3.0...

WordPress Mang Board plugin <= 2.4.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin Mang Board WP versions = 2.4.4...

EUVD-2026-102198

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...

CVE-2026-102631

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...