cve-2026-23989-opencloud-lab

CVE-2026-23989 — OpenCloud / ownCloud Infinite Scale public-link scope bypass A self-contained, one-command lab that reproduces CVE-2026-23989 and proves it fixed, using the official upstream Docker images. A public share link that is supposed to grant access to one folder can be abused to read...

CVE-2026-104189 3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share

The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents...

CVE-2026-104189

The 3D Viewer for Nextcloud (versions 1.7.9 through 3.3.1) contains a vulnerability where share passwords are not enforced when streaming 3D models via public links. The root cause is that PublicFileController extends OCP\AppFramework\Controller instead of OCP\AppFramework\PublicShareController, ...

PT-2026-98360

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn fr...

Malicious code in grid-public-link-route-rain (npm)

The package grid-public-link-route-rain was found to contain malicious code. --- Credit: OpenSSF source...

Exploit for Incorrect Authorization in Heinlein Opencloud_Reva

CVE-2026-23989 — OpenCloud / ownCloud Infinite Scale public-li...

PT-2026-83089

filebrowser through 2.63.23 does not remove share records when a shared file is renamed only deletion triggers share cleanup. The share record is keyed by path, so it survives the rename and remains dormant returning 404 while the path is empty. When any new, unrelated file later appears at the...

CVE-2026-65710

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

CVE-2026-65710

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

CVE-2026-65710 sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

CVE-2026-65710 sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

CVE-2026-65710 sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

EUVD-2026-48716

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

CVE-2026-65710

SysPass 3.2.11 is affected by a missing authorization vulnerability in the PublicLink flow. Authenticated users with the PUBLICLINK_CREATE profile flag can trigger unauthorized decryption and persistence of vault passwords by abusing the absence of AccountAcl checks in the public link creation pa...

PT-2026-64377

Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12 Description Authenticated users possessing the PUBLICLINK CREATE profile flag can trigger unauthorized decryption and persistent storage of any vault account password. This occurs due to missing AccountAcl chec...

CVE-2026-61874 filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete

filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose ne...

GHSA-HW9R-6M78-W6H3

creationtimestamp| type| source ---|---|--- 2026-06-08 15:11:10+00:00| seen| https://gist.github.com/alon710/56fac469b83d68f32bede1d2945e0063...

CVE-2026-45285

A flaw was found in Nextcloud. When a user shares a folder or file with a Nextcloud Team that includes an external member, the system automatically generates a public link for that external member. This link, which is not visible to the folder owner, grants the same permissions as the Team's...

CVE-2026-45285

Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includes an external member a person added via email address who does not have a Nextcloud account, the...

CVE-2026-45285

Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includes an external member a person added via email address who does not have a Nextcloud account, the...