CVE-2026-110234

The software Elio (versions through 1.13.0 ) is vulnerable to an insecure temporary file creation (CWE-377) in the external preview command capture. A local attacker who knows the victim's Elio process ID can pre-create a symbolic link at a predictable capture path. When the victim previews media...

CVE-2026-110235

The MP Manager application, versions through 1.1.0 , is vulnerable to a path traversal flaw during archive extraction. The root cause is a bypass of the non-recursive sanitizeEntryName filter, which fails to correctly handle specially crafted entries. Attackers can craft TAR , 7z , or RAR files c...

EUVD-2026-99018

Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives...

CVE-2026-110234

Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives...

CVE-2026-110234 Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture

Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives...

EUVD-2026-99016

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../x/file to create or overwrite files in sibling folders...

CVE-2026-110232 Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../x/file to create or overwrite files in sibling folders...

CVE-2026-110119

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/id, /address/del and...

CVE-2026-110121

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/goodsId to...

CVE-2026-110109

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/productId. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec...

CVE-2026-110100

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse getheaders an...

CVE-2026-110121 PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/goodsId to...

EUVD-2026-98952

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/goodsId to...

CVE-2026-110121 PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/goodsId to...

CVE-2026-110121 PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/goodsId to...

CVE-2026-110121

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/goodsId to...

CVE-2026-110121

PickMall lilishop versions through 4.4 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639) within the goods update endpoint. Authenticated sellers can exploit this by sending PUT requests to /store/goods/goods/update/{goodsId} using a goodsId belonging to a differ...

CVE-2026-110119 yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/id, /address/del and...

EUVD-2026-98950

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/id, /address/del and...

CVE-2026-110109

Versions of JetLinks Community through 2.10.0 are susceptible to a missing authorization vulnerability (CWE-862) in the transparent-codec component. An attacker with only query access can exploit the POST /device/transparent-codec/{productId} endpoint, which lacks the required @SaveAction permiss...