Pheditor has an authenticated terminal command whitelist bypass

CVE-2026-54540

### Summary Pheditor 2.0.4 has an authenticated terminal command whitelist bypass. The terminal feature checks whether

历史摘要 · 未重新核验 · GitHub Advisory

adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files

### Impact `adawolfa/isdoc` reads ISDOC invoices from ISDOCX (ZIP) archives and from PDF files with embedded ISDOC docu

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT: Stored XSS in print_all_bug_page_word.php

CVE-2026-62944

A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML int

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs

CVE-2026-52883

Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows creation of TIME_TRACKING and REMINDER Notes. Th

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters

CVE-2026-52882

### Impact Users below _report_issues_for_unreleased_versions_threshold_ can assign unreleased product versions. ### Pa

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT: Reflected XSS in admin/install.php via unescaped printf

CVE-2026-52881

MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameter

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT: Reflected XSS in admin/install.php

CVE-2026-52847

MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameter

历史摘要 · 未重新核验 · GitHub Advisory

Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

CVE-2026-54494

## Summary Koel's outbound-URL guard `App\Helpers\Network::isPublicHost()` classifies an IP as "public" using PHP's `fi

历史摘要 · 未重新核验 · GitHub Advisory

Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail

CVE-2026-50552

Summary Koel v9.5.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint

历史摘要 · 未重新核验 · GitHub Advisory

Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

CVE-2026-54491

### Summary The fix for **CVE-2026-47260** (v9.3.5) added an **initial** `isSafeUrl()` check to several fetchers (`sync

历史摘要 · 未重新核验 · GitHub Advisory

Koel has SSRF through Authenticated Subsonic podcast feed URLs

## Summary Koel's Subsonic `createPodcastChannel.view` endpoint accepts a user supplied podcast feed URL and fetches it

历史摘要 · 未重新核验 · GitHub Advisory

FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

## Summary `FacturaScripts\Core\UploadedFile::move($destiny, $destinyName)` concatenates `$destiny` and `$destinyName`

历史摘要 · 未重新核验 · GitHub Advisory

EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField

CVE-2026-54087

EasyAdmin's `FileField` and `ImageField` accept browser-executable file types by default (`FileField` applies no MIME/ex

历史摘要 · 未重新核验 · GitHub Advisory

Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter

CVE-2026-50157

### Description Applications built with the Auth0 Symphony SDK, using the Authorizer security authenticator to protect H

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

CVE-2026-52828

### Summary The `ExportController` web routes for creating and editing export templates are gated only by the class-lev

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP

CVE-2026-52827

### Summary Two-factor authentication (TOTP) can be fully bypassed for the REST API. The `KIMAI_SESSION` cookie returned

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

CVE-2026-52826

### Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the Web rate editing flows f

历史摘要 · 未重新核验 · GitHub Advisory

Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility

CVE-2026-52825

### Summary Kimai contains an authenticated improper authorization vulnerability in Team-related assignment APIs. A Tea

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

CVE-2026-52824

### Summary The official Kimai Docker image ships with `APP_SECRET=change_this_to_something_unique` as the default envi

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

CVE-2026-52823

### Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its timesheet state-changing API e

历史摘要 · 未重新核验 · GitHub Advisory