CVE-2026-65700 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The getuserdir function in...

CVE-2026-65700

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The getuserdir function in...

CVE-2026-65700

CVE-2026-65700 affects h2oGPT 0.2.1 via the OpenAI-compatible files API. The vulnerability arises from a path traversal weakness in get_user_dir where the bearer token is unsafely used as a path component with os.path.join, allowing unauthenticated remote attackers to read, write, and delete file...

CVE-2026-47752 Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection SSTI in the notification template feature. The titletemplate and bodytemplate fields are rendered using an unsandboxed jinja2.Environment, allowing...

openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()

A flaw was found in OpenSSL. When processing a specially crafted PKCS7 or S/MIME Secure/Multipurpose Internet Mail Extensions signed message, a heap use-after-free vulnerability in the PKCS7verify function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an emp...

Microsoft Account Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network...

Microsoft M365 Copilot Remote Code Execution Vulnerability

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...

Azure API Management (APIM) Remote Code Execution Vulnerability

Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the dynamicDataField function in the FlexDirectory...

CVE-2026-65690 Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal...

CVE-2026-65690

Bold Reports Standalone Report Designer, versions before 14.1.12, is affected by a path traversal vulnerability in the file upload feature due to missing filepath validation. This allows an authenticated attacker to supply a crafted filename to traverse outside the intended directory and potentia...

CVE-2026-65690 Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal...

CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...

CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...

EUVD-2026-48244

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...

CVE-2026-65608

Grav prior to 2.0.9 is vulnerable to remote code execution via FlexDirectory. The flaw in FlexDirectory::dynamicDataField() uses attacker-influenced input with call_user_func_array() and only validates that the target is callable, allowing arbitrary shell commands when an authenticated user with ...

CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...

CVE-2026-65606 SiYuan before v3.7.2 Cross-Site Scripting to RCE

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

CVE-2026-65606

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, SiYuan Desktop opens a custom tab and inserts the link’s icon parameter into the tab header via innerHTML without ...

CVE-2026-65605

SiYuan prior to v3.7.2 is vulnerable to a stored XSS in the Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, with EscapeHTML applied only when HasUnclosedHtmlTag is true; balanced self-closing tags like can bypass this...