When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.
The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
BookStack versions before 26.09.2 have an authorization vulnerability in the AttachmentController that allows authenticated users with attachment permissions to access draft page attachments of other users by enumerating attachment IDs. This can lead to unauthorized downloading, renaming, relinking, or replacing of files on unpublished draft pages.
Grav versions from 2.0.15 up to but not including 2.2.13 contain a vulnerability that allows attackers with page-edit permissions to bypass allowlist restrictions and invoke arbitrary public static methods. This can lead to unauthorized deletion of directories, overwriting of files, or reading files outside the intended page tree by embedding crafted fields in Flex form overrides within page frontmatter.
CVE-2026-116018 is an insecure direct object reference vulnerability in ONEARMY community-platform versions before 2.165.2. It allows authenticated users to mark other users' notifications as read by manipulating notification IDs in API requests. This can cause users in the same tenant to miss important notifications such as replies, comments, and new content alerts.
Xiaozhi-esp32-server versions before 0.9.8 have an insecure direct object reference vulnerability in the DeviceController.getAddressBook API. Authenticated users, including those with self-registered accounts, can access other users' device address books by specifying another user's device MAC address. This exposes contact MACs, aliases, call permissions, and owner user IDs.
CVE-2026-116016 is an authorization bypass vulnerability in yudao-cloud through version 2026.09. Authenticated users can bypass row-level data scope restrictions by sending a specially crafted header (data-permission-enable set to false) in /admin-api requests. This allows unauthorized reading or modification of other departments' and users' records within the same tenant.
CVE-2026-116015 is an authorization bypass vulnerability in the yudao-cloud product by YunaiV, affecting versions up to 2026.09. It allows authenticated users to access other members' after-sale operation logs by manipulating the afterSaleId parameter. This can expose sensitive information such as refund amounts, status changes, and timestamps.
CVE-2026-116013 is a vulnerability in OpenResty lua-resty-dns versions before 0.24 where improper input validation in parse_section() and _decode_name() allows attackers controlling or spoofing a DNS server to send malformed DNS responses. This causes uncaught Lua exceptions in resolver:query(), aborting DNS requests and breaking name resolution.
Ghidra versions prior to 12.2 contain a numeric truncation vulnerability in the PackedDecode::skipAttribute and skipAttributeRemaining functions. This flaw arises from storing 64-bit string lengths in 32-bit variables, which can be triggered by a crafted packed stream such as a malicious .sla file. Exploitation may allow injection of attributes into the decompiler's input or cause the decompiler process to crash. The vulnerability has a low CVSS score and does not indicate critical impact or widespread exploitation.
CVE-2026-116011 is a high-severity vulnerability in Crow versions before 1.3.4. It involves uncontrolled recursion in the crow::json::load() function, which can be triggered by sending deeply nested JSON objects. This causes the server's worker thread stack to be exhausted, leading to process termination and dropped connections.
RosarioSIS versions prior to 12.9.1 have an authorization bypass vulnerability that allows authenticated teachers to modify records for students outside their assigned course periods. By manipulating specific POST parameters in several PHP scripts, attackers can create or alter referrals, eligibility codes, attendance, and final grades for any student in the system.
Camaleon CMS versions before 2.9.3 have a path traversal vulnerability that allows users with media permissions to write arbitrary files by manipulating the name parameter with ../ sequences. This can be exploited by sending a base64 data URI to the crop_url media action, enabling attackers to write an ERB template into a theme's views directory, which executes when rendered.
DaybydayCRM versions up to 2.2.1 have a missing authorization vulnerability in the ProjectsController::updateAssign() function. This flaw allows any authenticated user, including low-privileged employees, to reassign projects without having the required permission. Attackers can send PATCH or POST requests to the /projects/updateassign/{external_id} endpoint with a chosen user_assigned_id to redirect project ownership and notifications.
The aBlocks WordPress plugin up to version 2.17.0 contains a privilege escalation vulnerability via a REST endpoint that allows authenticated users with Contributor-level access or higher to elevate their role to Editor or other non-administrator roles. This occurs because the endpoint does not properly verify permissions and reads role information from attacker-controlled content. The vulnerability is bounded to roles below administrator level.
Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.
The php2shell vulnerability requires multiple consecutive requests to the same PHP worker process and knowledge of the exact PHP build to exploit. Due to typical production environments having multiple PHP workers behind load balancers and constant background traffic, exploitation is impractical against moderate to high traffic sites. Exploiting the vulnerability involves a denial-of-service-like brute force approach over days or weeks, which is likely to be detected and mitigated by existing protections such as WAFs and rate limiting. While critical and deserving prompt patching, the vulnerability is mainly a practical threat to very low-traffic, unprotected sites. No confirmed successful exploitation in the wild has been observed at the time of analysis.
CVE-2026-115998 is an Insecure Direct Object Reference (IDOR) vulnerability in CervantesSec cervantes version v1.3-beta. It allows an authenticated attacker to access sensitive data such as findings, proof-of-concept details, credentials, and client information from projects they do not belong to. The attacker can also modify finding statuses and transfer findings to their own projects, impacting data confidentiality and integrity.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
CVE-2026-115994 is an authorization bypass vulnerability in CervantesSec cervantes version v1.3-beta. It allows an attacker with limited privileges to modify or delete targets belonging to other projects without proper authorization. This compromises the integrity of penetration testing scopes, results, and associated security reports. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).
CVE-2026-115993 is a stored cross-site scripting (XSS) vulnerability in the Notes field of the Checklists feature in Cervantes version v1.3-beta. This flaw allows an attacker to inject malicious scripts that execute in another user's browser with elevated privileges. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. No patch or remediation information is currently available, and there are no known exploits in the wild.