Dromara free-fs versions 2.0.1 through 2.3.1 have an authorization bypass vulnerability due to client-side enforcement of share codes. Attackers who know a share ID can access and download files from code-protected shares without needing the share code, even for preview-only shares.
Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permission can read the Django SECRET_KEY, reused as the NATS password, and publish runscript commands to every managed agent.
Keep versions 0.34.10 through 0.55.0 contain a blind SQL injection vulnerability in the CEL-to-SQL converter. Authenticated users with read:alert permission can exploit this flaw by submitting crafted CEL expressions to specific endpoints, allowing them to extract other tenants' alerts and password hashes via a boolean oracle technique.
Seafile SeaDoc versions 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contain an absolute path traversal vulnerability. This flaw allows unauthenticated attackers with a public share token to execute arbitrary code by supplying an absolute filename to a specific API endpoint, leading to malicious code importation.
PMail versions 2.9.1 through 2.9.8 have a stored cross-site scripting (XSS) vulnerability in the /attachments/{id}/{cid} endpoint. This endpoint returns email attachments with the sender-supplied Content-Type after rewriting cid: references into attachment links. An unauthenticated SMTP sender can exploit this by sending a text/html attachment and a page-covering cid link, causing the recipient's webmail session to execute malicious script, potentially allowing password changes including for administrators.
PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover.
FileCodeBox versions 2.2.1 through 2.8.4 have a stored cross-site scripting (XSS) vulnerability in the renderMarkdownPreview function. This flaw occurs because unsanitized text is returned when the marked parser throws an error. Unauthenticated attackers can exploit this by sharing text containing many nested blockquote markers followed by malicious HTML, enabling script execution that can steal the admin token from localStorage.
NginxPulse versions from 1.5.0 up to but not including 1.6.26 contain an unauthenticated SQL injection vulnerability in the /api/stats/:type endpoint via the id and locationType parameters. This flaw allows remote attackers to manipulate SQL commands, potentially reading database contents and accessing or modifying server files through PostgreSQL superuser functions. The vulnerability is critical with a CVSS 4.0 score of 9.3. A fix is available in version 1.6.26.
EdgeEver versions 1.9.0 up to but not including 2.13.0 contain a stored cross-site scripting (XSS) vulnerability in the backup restore endpoint. This flaw allows authenticated users to share a note with a crafted public blob link that causes a victim's browser to execute malicious script. The script can mint a non-expiring API token granting read and write access to the victim's notes. The vulnerability is fixed in version 2.13.0.
Nuxt is an open-source web development framework for Vue.js. From 3.5.0 until 4.6.4, Nuxt can choose a parent directory as the default workspaceDir in either of two cases: a stray parent lockfile when the project is outside a Git repository and has no workspace file above it, or a parent pnpm or Deno settings file that does not declare packages or a workspace, including when the project is inside a Git repository. When the development server is reachable from an untrusted network, Vite permits /_nuxt/@fs/ requests beneath that widened directory, allowing unauthenticated clients to read files such as credentials and SSH keys. The issue affects the development server only; production builds and projects whose parent directories contain no qualifying files are unaffected. This issue is fixed in version 4.6.4.
A cross-site scripting (XSS) vulnerability exists in rails-html-sanitizer versions prior to 1.7.2 due to unsafe reuse of a permit scrubber in multithreaded environments. Concurrent sanitization calls with different allowlists can cause one call to use another's permissive allowlist, potentially allowing script elements or event-handler attributes to bypass sanitization. This issue is fixed in version 1.7.2.
A vulnerability in rails-html-sanitizer versions 1.0.3 through 1.7.1 allows an attacker to cause uncontrolled resource consumption (CPU usage) by supplying crafted HTML with SVG reference elements and certain href attributes. This leads to quadratic CPU consumption due to inefficient regular expression matching in affected Ruby interpreters. The issue is fixed in version 1.7.2.
CVE-2026-123965 is a critical prompt injection vulnerability in all versions of Jet Admin Cloud Platform. It allows a remote attacker with a free account to access sensitive .env configuration files and exfiltrate critical credentials. The vulnerability was mitigated around October 29, 2026, by implementing a sandbox component.
Catalis WebPro 5.0 contains a SQL Injection vulnerability that allows remote unauthenticated attackers to execute arbitrary SQL queries on the underlying MSSQL database. This can lead to unauthorized access and exfiltration of sensitive property and taxpayer information. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.
Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Attackers who were previously members and authored objects can retain unauthorized read access to space objects even after being removed from the space, leading to persistent information disclosure.
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id() from predictable fields such as object creation time, which is self-disclosed through autorDate and the iCal CREATED field. Attackers can compute the creation minute and forge the md5Id token to access and read a shared calendar's iCal feed without authorization.
The 'tdesign-vue-mono' package version 1.0.1 on RubyGems has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged due to its communication with a domain linked to malicious activity. No CVSS score or detailed technical impact is provided.
Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can submit an error-based extractvalue payload through personsSort to leak database information, such as the MariaDB version, via the user and space listing pages.
Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context.