CVE-2026-126375

Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digitalassets directory. Attackers can send rename, delete, or upload requests to product/digital-asset...

CVE-2026-126375 Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait

Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digitalassets directory. Attackers can send rename, delete, or upload requests to product/digital-asset...

EUVD-2026-125190

Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digitalassets directory. Attackers can send rename, delete, or upload requests to product/digital-asset...

CVE-2026-126375

Versions of Vvveb through 1.0.8.6 are affected by a missing authorization vulnerability that enables cross-tenant digital asset tampering. A low-privilege vendor can access the shared storage/digital_assets directory to rename , delete , or overwrite files belonging to other vendors. By sending s...

EUVD-2026-117157

VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure to restrict scripts or force downloads...

CVE-2026-54380

VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure to restrict scripts or force downloads...

CVE-2026-54380 VitaFit Cloud API Stored XSS via SVG File Upload

VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure to restrict scripts or force downloads...

CVE-2026-54380

The VitaFit cloud API (versions prior to 2026-10-30) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the application's failure to restrict scripts or enforce downloads for image/svg+xml content. This allows authenticated attackers to upload an SVG image conta...

PT-2026-137214

Name of the Vulnerable Software and Affected Versions VitaFit cloud API versions prior to 2026-10-30 Description An authenticated attacker can upload an SVG image containing malicious JavaScript to the shared storage bucket. The issue occurs because the application fails to restrict scripts or...

CVE-2026-116243 pgAdmin 4: Utility binary path can point at a shared storage directory

pgAdmin 4 runs pgdump, pgrestore, pgdumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory STORAGEDIR, not under a SHAREDSTORAGE directory, which ordinary users can upload files to. A...

PT-2026-134155

pgAdmin 4 runs pg dump, pg restore, pg dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory STORAGE DIR, not under a SHARED STORAGE directory, which ordinary users can upload files...

CVE-2026-107053

Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox...

CVE-2026-107053

Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox...

CVE-2026-107053

The foobnix Librera PDF Reader (versionCode 7222 ) contains a vulnerability due to insecure permissions . This flaw allows unauthorized attackers to arbitrarily write and truncate files within a shared storage space located outside of the application's sandbox. Specific details regarding exploita...

CVE-2026-107053

Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox...

EUVD-2026-113260

Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox...

PT-2026-132385

Name of the Vulnerable Software and Affected Versions Librera PDF Reader version 7222 Description Insecure permissions allow unauthorized attackers to arbitrarily write to and truncate files within a shared storage space located outside of the application sandbox. This can lead to the alteration ...

CVE-2026-107053: n/a: Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write…

Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox...

Ivan Ivanenko Librera Reader security vulnerability

The Librera Reader version 7222 by Ivan Ivanenko contains a security vulnerability stemming from improper permission settings. This vulnerability may allow unauthorized attackers to write and truncate files within shared storage space outside the sandbox...

Red Hat OpenShift AI authorization issue vulnerability

Red Hat OpenShift AI has an authorization issue vulnerability. This vulnerability arises because the service fails to validate authorization before retrieving credentials from shared storage. An authenticated remote attacker can inject the target tenant’s API key into a request by specifying a...