CVE-2024-53255

CVE-2024-53255 boid CMS 2.1.1 - reflected Cross-Site Scripting XSS Description: A reflected XSS vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code Steps to exploit: 1- Login to the CMS and Navigate to the delete...

EUVD-2026-94066

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

PT-2026-107308

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The API endpoint GET /api/v1/repos/owner/repo/media/filepath fails to include the proper content type and disposition headers when serving files up to 1 KiB stored directly in Git rather than i...

CVE-2026-54258

ZoneMinder , a free open-source closed-circuit television (CCTV) application, is affected by an authorization bypass in direct event media endpoints. In versions prior to 1.36.39 , 1.38.4 , and 1.39.11 , an authenticated low-privileged user holding only coarse Events=View and/or Snapshots=View pe...

CVE-2026-55419

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

CVE-2026-55419 Reachy Mini: Unrestricted Upload of File with Dangerous Type

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

CVE-2026-55419 Reachy Mini: Unrestricted Upload of File with Dangerous Type

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

CVE-2026-53656

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

EUVD-2026-64145

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-53656

FiftyOne (open-source visual AI dataset platform) versions prior to 1.17.0 unconditionally set Access-Control-Allow-Origin: * on its locally running, unauthenticated App/API server. Because the /media endpoint accepts a filesystem path parameter, a malicious website can issue cross-origin request...

CVE-2026-53656 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

PYSEC-2026-3465 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

PT-2026-60789

Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to arbitrary hosts and ports by supplying an unvalidated serverName parameter to the legacy media download endpoint. Attackers ca...

FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

GHSA-Q78P-HJ9H-5466 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

PT-2026-60371

Name of the Vulnerable Software and Affected Versions FiftyOne versions prior to 1.17.0 Description The FiftyOne App/API server and the /media endpoint unconditionally set a permissive Cross-Origin Resource Sharing CORS header, allowing any website visited by a user to make cross-origin requests ...

EUVD-2026-42905

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile method validates only the file extension and never invokes Security::sanitizeSVG, so an authenticated attacker with t...

CVE-2026-61456

Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 is vulnerable to stored XSS via SVG uploads. The HandlesMediaUploads::processUploadedFile() path only validates file extension and does not call Security::sanitizeSVG(), enabling an authenticated attacker with api.media.write to upload an SVG...

CVE-2026-61456 Grav before 1.0.3 Stored XSS via SVG Upload API

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile method validates only the file extension and never invokes Security::sanitizeSVG, so an authenticated attacker with t...

PT-2026-57199

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile method validates only the file extension and never invokes Security::sanitizeSVG, so an authenticated attacker with t...