CVE-2026-107188

The Eptura Archibus software contains a vulnerability in the Workflow Rule component that allows for unauthenticated arbitrary file upload . An attacker can upload export reports containing malicious JSP code and specify a JSPX file extension. Because the uploaded file is accessible via a web bro...

EUVD-2026-104461

A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this...

CVE-2026-107188 Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this...

CVE-2026-112310

docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allowimagefileuri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported wit...

CVE-2026-111045

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

Python Packaging Authority virtualenv encryption vulnerability

The Python Packaging Authority virtualenv version 21.14.8 has a security vulnerability. This vulnerability stems from downloadwheel, which downloads the package index into a reusable cache before validating the target based on the Saved output from pip. Due to a flaw in the digest comparison, a...

tox-dev filelock: Processing logic error vulnerability

The tox-dev filelock version 4.1.0 to 4.2.1 contained a processing logic vulnerability. This vulnerability stemmed from the SoftFileLock component reusing outdated observation results when at least two lock user processes were waiting. An attacker could set and delete their own markers, and use...

CVE-2026-111053 FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/templateexists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or...

CVE-2026-111053

The open source billing platform FOSSBilling is vulnerable to a path traversal flaw in versions 0.1.0 through 0.8.7. The api/guest/system/template_exists endpoint improperly handles the file parameter by using Path::join without filtering .. sequences or validating the resolved path against the a...

CVE-2026-111053 FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/templateexists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or...

CVE-2026-111053 FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/templateexists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or...

EUVD-2026-104412

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

Malware in mp3-file-zip-d-ownload-challengers-ym2l6-mkqhum

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in alb-um-availa-ble-zip-mp3-file-470287-watch-my-moves-2zscf-aatbzj

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in mp3-file-zip-d-ownload-hypnotize-kpkk0-ygzaqq

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in mp3-file-zip-d-ownload-10759-grand-prix-ojzwj-auchhw

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in alb-um-availa-ble-zip-mp3-file-someone-to-drive-you-home-vbwzp-koufrz

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in alb-um-availa-ble-zip-mp3-file-31673-finally-1m7lu-usrooy

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in a-lbum-do-wnload-avai-lable-file-11522-seven-and-the-ragged-tiger-bkmqg-xorids

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in mp3-do-wnload-file-to-day-d-nu951-cjkdsy

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...