CVE-2026-79294

CVE-2026-79294 CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. Vulnerability Details Vulnerability Type: Stored/Stored-like...

CVE-2026-33146

CVE-2026-33146 A public share looked clean in the page tree, but the search endpoint told a different story. In Docmost, restricted child pages hidden from public share viewers could still leak through public share search results. Intro I found this issue while reviewing Docmost , an open-source...

FileBrowser: Symlink Following Escapes User Scope Allowing Arbitrary File Read Outside The Served Directory

Summary File read paths resolve symbolic links with "filepath.EvalSymlinks" and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope for example to...

OpenStack Manila 23.0.0 Incorrect Authorization

OpenStack Manila versions before 23.0.1 contain incorrect authorization vulnerabilities in public-share and export-location metadata operations. The supplied offline detector assesses supported upstream server releases against the documented affected ranges...

GHSA-MGQF-5MF5-PRFJ FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

Summary File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope for example to...

CVE-2026-116682 FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

OpenStack Manila authorization issue vulnerability

OpenStack Manila versions prior to 1.0.0 through 20.0.3, 21.0.0 through 21.0.3, 22.0.0 through 22.0.2, and 23.0.0 through 23.0.1 contain an authorization issue vulnerability. This vulnerability arises because multiple Manila API operations grant authorization solely within the context of the...

CVE-2026-46650 Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...

EUVD-2026-84174

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A...

PT-2026-96279

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.7 Description An issue exists where the 'GET /shares/:id?resource id=' endpoint serves resources with an attacker-controlled mime value and omits the Content-Disposition header when the resource title is...

CVE-2026-46650: Improper Neutralization of Input During Web Page Generation

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...

EUVD-2026-83248

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and...

CVE-2026-79294

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

CVE-2026-79294

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

CVE-2026-79294

Moonshot AI Kimi (specifically v1.0 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists within the HTML artifact Preview rendering and can be delivered through the public Share view component. This vulnerability allows a remote attacker to execute arbitrary code, w...

EUVD-2026-82973

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

EUVD-2026-76695

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-54165: Improper Neutralization of Input During Web Page Generation

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-82237

filebrowser through 2.63.23 has a stale-share-link vulnerability: when a shared file is renamed, the share record (keyed by path) is not cleaned up—only deletion triggers cleanup. The record stays dormant (returning 404) until a new, unrelated file appears at the original path via re-upload, anot...