CVE-2026-72859 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

CVE-2026-72859 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

CVE-2026-72859

Budibase 3.39.4 before 3.40.0 contains an authorization regression in the S3 attachment upload endpoint. Affected component: the attachments endpoint used to generate S3 PutObject presigned URLs. Root cause: the route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC...

CVE-2026-72838

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...

EUVD-2026-58652

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...

CVE-2026-72838 FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...

CVE-2026-72838 FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...

CVE-2026-72838

CVE-2026-72838 affects FileBrowser versions before 2.63.19. The root cause is that the TUS resumable-upload PATCH endpoint fails to enforce the declared Upload-Length, enabling authenticated users to write arbitrary data to disk. This can allow an attacker to send oversized request bodies that ex...

CVE-2026-72819

Grav CMS prior to 2.0.13 is affected by a remote code execution via the Flex Objects plugin settings validation. Authenticated users can upload a ZIP containing PHP code, bypassing name validation with array notation, triggering unZip on a malicious archive and writing PHP files to the web root f...

EUVD-2026-58633

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

GO-2022-1038 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

GO-2022-1095 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

GO-2025-3811 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2026-4474 vulnerabilities

Vulnerabilities for packages: filebrowser...

WordPress WP Photo Album Plus plugin < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability

Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability discovered by Farid Narimanov in WordPress Plugin WP Photo Album Plus versions 9.2.09.002...

EUVD-2026-58555

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to...

CVE-2026-19761

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to...