CVE-2026-115728 @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign,...

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

CVE-2026-97635

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...

EUVD-2026-108272

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...

CVE-2026-97635 Agent Zero Web UI XSS

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...

CVE-2026-97635

The Agent Zero Web UI versions prior to 1.15 are vulnerable to Cross-Site Scripting (XSS) due to improper sanitization of user-provided input in chat messages and file uploads . When the application reproduces content in the chat interface, injected JavaScript executes within the context of the v...

CVE-2026-97635 Agent Zero Web UI XSS

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...

AgentZero XSS

RISK EVALUATION The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI...

CVE-2026-114400

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket...

CVE-2026-114400 Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket...

EUVD-2026-107247

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket...

CVE-2026-114400 Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket...

CVE-2026-114400

Trudesk versions through 1.2.11 are vulnerable to a missing authentication flaw regarding ticket attachments. The root cause is that express.static serves the public/ directory before the hasAuth-guarded /uploads mount, allowing unauthenticated attackers to download private attachments. If an att...

CVE-2026-114400 Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket...

CVE-2026-114101

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename=iso-8859-1''shell.php, or filename alone, so...

CVE-2026-114101

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename=iso-8859-1''shell.php, or filename alone, so...

PT-2026-120587

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket...

PT-2026-120227

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename=iso-8859-1''shell.php, or filename alone, so...

npm: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory

npm: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

CVE-2026-113656

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated...