CVE-2026-83803: Deserialization of Untrusted Data

Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes...

PT-2026-96702

Name of the Vulnerable Software and Affected Versions LibreOffice Draw affected versions not specified Description A heap buffer overflow occurs during the import of encrypted PDF documents. The issue arises because the software uses the decryption key length specified in the document's encryptio...

CVE-2026-63273: Out-of-bounds Write

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length large...

CVE-2026-63274: Out-of-bounds Write

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the...

PT-2026-96703

Name of the Vulnerable Software and Affected Versions LibreOffice Draw affected versions not specified Description An issue exists when importing PDF documents where a heap buffer overflow occurs during the processing of a stream object. The software uses the stream length specified in the object...

CVE-2026-88416: Undefined Security Weakness

MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...

PT-2026-97031

Name of the Vulnerable Software and Affected Versions MCMS versions 6.1.1 through 6.2.1 Description A SQL injection issue exists within the custom model/form import feature. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially...

CVE-2026-88416

MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...

EUVD-2026-84858

MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...

EUVD-2026-84159

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback,...

CVE-2026-77522 MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback,...

CVE-2026-77522

MaxKB (open-source enterprise AI assistant by 1Panel-dev) versions 2.10.3-lts and earlier are affected by an authenticated full-read SSRF in the knowledge web-document import/sync crawler. The underlying cause is that Fork.fork invokes requests.get with verify=False and no restrictions on schemes...

CVE-2026-77522 MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback,...

CVE-2026-77522 MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback,...

CVE-2026-61747

InvenTree , an open-source inventory management system, is affected by an authenticated IDOR vulnerability in its data-import API prior to version 1.4.0 . The /api/importer/row/ and /api/importer/mapping/ endpoints fail to scope DataImportRow and DataImportColumnMap querysets to the owner of the ...

CVE-2026-61747 InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappings

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no...

CVE-2026-61747 InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappings

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no...

CVE-2026-61747 InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappings

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no...

CVE-2026-94401

MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify...

EUVD-2026-83913

MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify...