75068 matches found
CVE-2026-56768
Seahub before 13.0.23 does not enforce SHARELINKLOGINREQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory...
CVE-2026-54096
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, POST /api/share/ accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target fi...
CVE-2026-55961
creationtimestamp| type| source ---|---|--- 2026-06-25 18:50:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp53v6k6xb2f 2026-07-20 03:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr2ctsexk32s...
CVE-2026-55967
creationtimestamp| type| source ---|---|--- 2026-06-25 18:45:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp53m7oi7h2a...
GO-2026-5245 Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds in github.com/mattermost/mattermost-server
Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds in github.com/mattermost/mattermost-server...
GO-2026-5276 Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade in code.vikunja.io/api
Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
CVE-2026-11999
creationtimestamp| type| source ---|---|--- 2026-06-25 18:40:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp53db4z3t2y 2026-07-20 03:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr2ejgbdp52s...
CVE-2026-6291
creationtimestamp| type| source ---|---|--- 2026-06-25 18:35:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp532chywm2u...
GO-2026-5159 File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix in github.com/filebrowser/filebrowser
File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix in github.com/filebrowser/filebrowser...
CVE-2026-47770
creationtimestamp| type| source ---|---|--- 2026-06-25 18:25:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp52ieq6bl2u...
CVE-2026-50021
creationtimestamp| type| source ---|---|--- 2026-06-25 18:20:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp52ap4dzc2z 2026-06-27 00:35:37+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-q6j5-fjx5-2mc3...
CVE-2026-55180
creationtimestamp| type| source ---|---|--- 2026-06-25 18:10:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4zolmti52o 2026-06-27 00:35:17+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r 2026-06-29 23:02:17+00:00| seen|...
CVE-2026-56768 Seahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method
Seahub before 13.0.23 does not enforce SHARELINKLOGINREQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory...
CVE-2026-56768
Seahub before 13.0.23 does not enforce SHARELINKLOGINREQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory...
EUVD-2026-39520
Seahub before 13.0.23 does not enforce SHARELINKLOGINREQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory...
CVE-2026-56768 Seahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method
Seahub before 13.0.23 does not enforce SHARELINKLOGINREQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory...
CVE-2026-56768
Vulnerability summary (CVE-2026-56768) Seahub versions before 13.0.23 fail to enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated access when a folder share-link token is present. An attacker can call the GET endpoint to obtain a fileserver zip token ...
CVE-2026-56768 Seahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method
Seahub before 13.0.23 does not enforce SHARELINKLOGINREQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory...
CVE-2026-48995
creationtimestamp| type| source ---|---|--- 2026-06-25 18:03:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4zb2p3uk2s 2026-06-26 22:35:40+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-hg3w-7f8c-63hp 2026-06-29 22:43:27+00:00| seen|...