CVE-2026-41874

Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and...

CVE-2026-63303

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-18028

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...

CVE-2026-63303

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-63303

Summary: CVE-2026-63303 describes a path traversal in Quick.CMS where the URI path component does not normalize ../ sequences, allowing an authenticated admin to read files in the webroot’s sibling directory. Affected product is Quick.CMS (component: URI handling). Underlying cause: failure to no...

CVE-2026-63303 Path Traversal in Quick.CMS

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

EUVD-2026-49756

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-63302

Quick.CMS is vulnerable to Local File Inclusion (LFI) in admin.php via the p parameter. An authenticated admin can include arbitrary files within the application directory, leaking directory structure and absolute file paths. The vendor notes the exploitation likelihood as very low and states tha...

EUVD-2026-49755

Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...

CVE-2026-63302 Local File Inclusion in Quick.CMS

Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...

CVE-2026-63302

Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...

CVE-2026-63301

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

CVE-2026-63301 Denial of Service in Quick.CMS

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

CVE-2026-18028

CVE-2026-18028 describes a missing authorization check in the "+quick setup+" view presented after creating an event. The flaw allows an attacker to send well-timed requests to perform privileged actions on events the user should not access, including creating products, quotas, configuring bank t...

CVE-2026-18028 Missing authorization check in event quick setup view

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...

PT-2026-64452

Name of the Vulnerable Software and Affected Versions Knot Resolver versions prior to 6.4.1 Description A heap-based buffer overflow exists in the DoQ DNS-over-QUIC receive path, which could allow remote code execution. A heap-based buffer overflow occurs when a program writes more data to a...

CVE-2026-16318 QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls

The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2nalloc instead of s2nrealloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2nalloc zeroes...

CVE-2026-44452 h2o is vulnerable to heap overrun

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it ...

EUVD-2026-36117

Sharp Missing Authorization Check in Quick Creation Command Endpoints...

GHSA-VMWX-M75V-QVCH Sharp Missing Authorization Check in Quick Creation Command Endpoints

Impact The create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that...