CVE-2026-32867 OPEXUS eComplaint unauthenticated file upload

OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/EEOC/DocumentUploadPub.aspx'. Users would see these unexpected files in cases. Uploading a large number of files could consume storage...

CVE-2026-32867

CVE-2026-32867 affects OPEXUS eComplaint prior to version 10.1.0.0. An unauthenticated attacker can obtain or guess an existing case number and upload arbitrary files through Portal/EEOC/DocumentUploadPub.aspx, causing unexpected files to appear in cases and potentially increasing storage usage. ...

nvme: fix memory allocation in nvme_pr_read_keys()

...

Security Bulletin: IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service is vulnerable due to jackson-core. (CVE-2025-52999)

Summary jackson-core-2.13.1.jar is updated to jackson-core-2.18.3.jar in the latest IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service repo where security vulnerability is not observed. CVE-2025-52999. Vulnerability Details CVEID:CVE-2025-52999 DESCRIPTIO...

OPEXUS eComplaint 安全漏洞

OPEXUS eComplaint is a complaint and appeal management platform provided by the US company OPEXUS. Versions of OPEXUS eComplaint prior to 10.1.0.0 contained security vulnerabilities. These vulnerabilities allowed unauthenticated attackers to upload arbitrary files, potentially leading to storage...

HCL Unica Marketing Operations 安全漏洞

HCL Unica Marketing Operations is a marketing activity management platform of the Indian company HCL. Versions of HCL Unica Marketing Operations 12.1.8 and earlier contained security vulnerabilities. These vulnerabilities were due to improper handling of data from unreliable sources, and could le...

PT-2026-26336

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.7.1 Description Langflow is susceptible to an arbitrary file write issue through the POST /api/v2/files API endpoint. The vulnerability stems from a lack of boundary containment checks in the storage layer, which...

SQLBot 安全漏洞

SQLBot is an intelligent data querying system developed by DataEase, based on large models and RAG techniques. Versions of SQLBot 1.5.0 and earlier contained security vulnerabilities. These vulnerabilities were caused by storage-based prompt injection attacks, which could allow attackers to hijac...

PT-2026-26309

OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/EEOC/DocumentUploadPub.aspx'. Users would see these unexpected files in cases. Uploading a large number of files could consume storage...

PT-2026-26491

Summary POST /objects/aVideoEncoder.json.php accepts a requester-controlled chunkFile parameter intended for staged upload chunks. Instead of restricting that path to trusted server-generated chunk locations, the endpoint accepts arbitrary local filesystem paths that pass isValidURLOrPath. That...

PT-2026-26481

Name of the Vulnerable Software and Affected Versions MinIO versions RELEASE.2022-11-08T05-27-07Z through RELEASE.2026-03-17T21-25-16Z Description MinIO has a JWT algorithm confusion issue in its OpenID Connect authentication. An attacker who knows the OIDC ClientSecret can forge identity tokens...

openSUSE 16 Security Update : MozillaFirefox (openSUSE-SU-2026:20365-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20365-1 advisory. - Firefox Extended Support Release 140.8.0 ESR bsc1258568 - CVE-2026-2757: Incorrect boundary conditions in the WebRTC: Audio/Video component -...

Important: thunderbird

Issue Overview: Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox 148, Firefox ESR 115.33, and Firefox ESR 140.8. CVE-2026-2757 Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox 148, Firefox ESR 115.33, and...

Important: firefox

Issue Overview: Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox 148, Firefox ESR 115.33, and Firefox ESR 140.8. CVE-2026-2757 Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox 148, Firefox ESR 115.33, and...

Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload

Summary The storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload files with an arbitrary MIME type, bypassing any MIME-type-based restrictions configured on storage buckets...

GHSA-G9F6-9775-HFFM Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload

Summary The storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload files with an arbitrary MIME type, bypassing any MIME-type-based restrictions configured on storage buckets...

CVE-2025-71269

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not free data reservation in fallback from inline due to -ENOSPC If we fail to create an inline extent due to -ENOSPC, we will attempt to go through the normal COW path, reserve an extent, create an ordered extent, etc...

web-app-security-project

🛡️ Web Application Security Project 📌 Overview This projec...

CVE-2026-33003

Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2026-33003

Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...