CVE-2026-67449

Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler app/api/tus/hooks/route.ts allowed an unauthenticated attacker to...

DRUPAL-CONTRIB-2026-337

The S3 File System CORS Upload module lets users upload files straight from the browser to Amazon S3 or an S3-compatible service, using a file widget on entity forms. The module doesn't sufficiently restrict the upload permission it gives the browser. A user who can upload through the widget can...

CVE-2026-67449: portabase: Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB,…

Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler app/api/tus/hooks/route.ts allowed an unauthenticated attacker to...

PT-2026-145661

The S3 File System CORS Upload module lets users upload files straight from the browser to Amazon S3 or an S3-compatible service, using a file widget on entity forms. The module doesn't sufficiently restrict the upload permission it gives the browser. A user who can upload through the widget can...

CVE-2026-125330

HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessabl...

PT-2026-144405

HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessabl...

CVE-2026-124034 Path traversal in Amazon Braket SDK local hybrid job input data download

Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3...

CVE-2026-124034

A relative path traversal vulnerability exists in the Amazon Braket SDK (versions before 1.127.7 ) during the local hybrid job input data download process. A remote authenticated user with S3 write access to a hybrid job's input data location can use crafted S3 object keys to overwrite arbitrary ...

EUVD-2026-120499

Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3...

EUVD-2026-119381

Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like /.bashrc or install vean...

CVE-2026-68509 FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path componen...

CVE-2026-68509 FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path componen...

CVE-2026-68509

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path componen...

CVE-2026-68509 FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path componen...

CVE-2026-68509

The FairEmail Android application (prior to version 1.2325 ) is vulnerable to a path traversal flaw in its shared attachment handling. The application fails to adequately sanitize attacker-controlled filenames when constructing destination paths. This allows a local malicious app to supply path c...

CVE-2026-62268

borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve embedded dot-dot path components and delete or overwrite files outside the extraction...

EUVD-2026-117654

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden ziptodir parameter, while cleanpath does not reject traversal sequences. An authenticated administrator can copy...

CVE-2026-76150 Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage

Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content vi...

EUVD-2026-117488

Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content vi...

CVE-2026-76150

Apache OFBiz versions through 24.09.07 are vulnerable to path traversal and missing authorization checks within the replaceImageToExistImage service on all platforms. A remote authenticated attacker with only Catalog view permission can exploit this by providing crafted productId, dataResourceNam...