Base de CVEs

CVE-2024-14046 Média · 6.3 CWE-284 18/08/2026

OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload

A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Controller. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.2 is capable of addressing this issue. The identifier of the patch is e945d6bfcec29642f514e7d298dfba2cc6cd7cd4. Upgrading the affected component is recommended.

CVE-2026-42163 Crítica · 9.8 CWE-284 17/08/2026

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal…

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.

CVE-2026-68004 Crítica · 9.8 CWE-284 17/08/2026

An issue in OSSRS SRS (Simple Realtime Server)

An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration (security.enabled), SrsSecurity::check(), trunk/src/app/srs_app_security.cpp, and SRS RTMP listener components

CVE-2026-73061 Crítica · 9.8 CWE-284 16/08/2026

Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.

CVE-2026-19711 Média · 6.5 CWE-284 16/08/2026

Premium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request

The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.

CVE-2026-14229 Média · 5.3 CWE-284 15/08/2026

ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.

CVE-2026-71570 Média · 5.1 CWE-284 14/08/2026

Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11

Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to `com_icagenda` only could enumerate Joomla user profiles.

CVE-2026-19839 Média · 4.7 CWE-284 14/08/2026

SourceCodester Simple Doctors Appointment System save_file.php save_doctor unrestricted upload

A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit is now public and may be used.

CVE-2026-72837 Alta · 8.8 CWE-284 14/08/2026

File Browser before 2.63.20 Privilege Escalation via Proxy Authentication

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.

CVE-2026-59763 Média · 4.3 CWE-284 13/08/2026

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

CVE-2026-58508 Crítica · 9.1 CWE-284 13/08/2026

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

CVE-2026-58507 Média · 5.3 CWE-284 13/08/2026

Private Repository Existence Disclosure via go-get Meta Endpoint

CVE-2026-58440 Média · 6.8 CWE-284 13/08/2026

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

CVE-2026-58439 Alta · 8.1 CWE-284 13/08/2026

Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

CVE-2026-58437 Alta · 7.1 CWE-284 13/08/2026

Repository Visibility Manipulation via Git Push Options

CVE-2026-58429 Média · 4.9 CWE-284 13/08/2026

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

CVE-2026-58420 Média · 4.4 CWE-284 13/08/2026

Local File Inclusion via file:// URI in Migration Restore

CVE-2026-58417 Alta · 7.5 CWE-284 13/08/2026

REST API exposes organization membership of private organizations to public

CVE-2026-56755 Média · 6.2 CWE-284 13/08/2026

Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

CVE-2026-56750 Crítica · 9.1 CWE-284 13/08/2026

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

CVE-2026-56657 Média · 6.2 CWE-284 13/08/2026

Gitea SSH Key Parser Denial of Service

CVE-2026-56654 Crítica · 9.8 CWE-284 13/08/2026

Privilege Escalation via Access Token Scope Escalation in API

CVE-2026-55986 Média · 5.4 CWE-284 13/08/2026

Email Management API Bypasses ManageCredentials Feature Restrictions

CVE-2026-55984 Baixa · 2.7 CWE-284 13/08/2026

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

CVE-2026-73626 Alta · 7.5 CWE-284 13/08/2026

JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager

JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are not affected, as they perform a separate, correctly awaited check. The issue affects only deployments where a custom extension or downstream integration imports PyPIExtensionManager and calls install() directly with a package name influenced by untrusted input, an allowlist/blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts. Fixed in JupyterLab 4.6.2 and 4.5.10.