9196 matches found
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Impact A vulnerability in multer 2.2.0 allows an attacker to trigger a Denial of Service DoS by aborting or truncating multipart uploads. When using diskStorage, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file...
GHSA-QFVM-CV95-JQJF multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Impact A vulnerability in multer 2.2.0 allows an attacker to trigger a Denial of Service DoS by aborting or truncating multipart uploads. When using diskStorage, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file...
NPM: multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
NPM: multer vulnerable to Denial of Service via file descriptor leak on aborted uploads vulnerability discovered by ? in WordPress Npm multer versions 2.2.0...
CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
EUVD-2026-72507
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...
CVE-2026-86491
JetBrains YouTrack versions prior to 2026.2.18634 were affected by a stored XSS vulnerability exploitable through project and organization icon uploads . An attacker with high privileges (e.g., an authenticated user with project or organization admin rights) could inject malicious scripts that ex...
CVE-2026-86491
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...
PT-2026-86863
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...
CVE-2026-86491: Improper Neutralization of Input During Web Page Generation
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...
CVE-2026-86285: Improper Access Control
A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper acces...
MAL-2026-15936 Malicious code in trongridew (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 598687794d8452d6845a3529e26bf63838cedee736dc0b8545ad33abe2e827f3 The package exposes a single public function permprivatekey in main.py that unconditionally POSTs the caller-supplied Tron private key as JSON to the...
CVE-2026-19769 Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. Thi...
CVE-2026-19769
The Ninja Forms WordPress plugin (versions ≤ 3.15.1 ) is affected by an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization and output escaping in the Repeater Child 'type' field. When the File Uploads add-on is active, an attacker can route a...
EUVD-2026-71880
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. Thi...
PT-2026-86324
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. Thi...
CVE-2026-19769: Improper Neutralization of Input During Web Page Generation
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. Thi...
CVE-2026-79631: Exposure of Sensitive Information to an Unauthorized Actor
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled...
CVE-2026-81773
Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...
CVE-2026-81773 WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...