CVE-2026-126951

Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the...

CVE-2026-126949

Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database...

CVE-2026-126948

Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete ...

EUVD-2026-125210

OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with clientcredentials enabled. Attackers who know a public client's clientid can request tokens from the...

EUVD-2026-124980

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by placing payloads in the patient External ID field. The payload executes when other users open the patient's prescriptions via View Printable Version HTML, running script ...

CVE-2026-126450

OpenEMR versions before 8.5.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. An authenticated user can inject malicious scripts by placing payloads into the patient External ID field. These scripts execute in the browser sessions of other users who access the patient's presc...

CVE-2026-126939

Versions of Zipline prior to 4.6.4 are vulnerable to an information disclosure flaw in the GET /api/server/folder/:id endpoint. An unauthenticated attacker who possesses a folder UUID can supply a page query parameter to bypass the metadata-only early return. This allows for the enumeration of fi...

EUVD-2026-125126

Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early retur...

CVE-2026-126941 Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints

Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take ov...

CVE-2026-126941

Zipline versions through 4.6.2 are vulnerable to an authorization bypass due to missing canInteract checks on specific user endpoints. Authenticated administrators can exploit the GET /api/users and GET /api/users/:id endpoints to access superadmin secrets , including plaintext totpSecret and OAu...

EUVD-2026-125124

Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take ov...

CVE-2026-126948

Zipline versions prior to 4.5.0 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). The root cause is a missing ownership verification within the PATCH and DELETE handlers for the /api/user/folders/:id endpoints. An authenticated attacker can exploit this by sup...

EUVD-2026-125116

Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database...

CVE-2026-126949

Zipline through version 4.4.0 is vulnerable to a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint. This flaw allows authenticated users with high privileges to overwrite existing uploads by providing unsanitized names . Because the system performs a database uniquenes...

EUVD-2026-125114

Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the...

CVE-2026-126951

Zipline through version 4.4.0 is affected by an authenticated path traversal vulnerability in the /api/user/files/:id/raw endpoint. The root cause is a fallback mechanism that incorrectly treats the :id parameter as a datasource key . By sending encoded traversal sequences in the :id parameter, a...

CVE-2026-126951 Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw

Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the...

CVE-2026-127093

Rustrak versions prior to 0.26.0 are vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists within the Alert Integration Test functionality, where users with integrations update permissions can trigger requests to arbitrary destinations by providing a routing_override.url parameter ...

CVE-2026-127093 Rustrak before 0.26.0 SSRF via Alert Integration Test routing_override.url

Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routingoverride.url to POST /api/integrations/id/test. Attackers can target loopback, private-network and cloud...

EUVD-2026-125090

Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routingoverride.url to POST /api/integrations/id/test. Attackers can target loopback, private-network and cloud...