GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
GitLab · Community Edition and Enterprise Edition · CWE-190
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe · Commerce and Magento · CWE-434
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
Google Brotli Unchecked Return Value Vulnerability
Google · Brotli · CWE-252, CWE-787
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Collabora · Collabora Online – Built-in CODE Server · CWE-78
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust · Remote Support · CWE-290
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Atlassian · Multiple Products · CWE-552
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
CVE-2015-3306Critical · CVSS 10.0added on 10/08/2026
ProFTPD Improper Access Control Vulnerability
ProFTPD · ProFTPD · CWE-284
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE · Docs · CWE-22
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
Want to know if your environment is exposed?
We assess versions, access and integrations of your ERP and infrastructure and prioritize the fixes.
Bit is an AI and can make mistakes. Do not share passwords or personal data. Conversations are not stored. Learn more
Your privacy matters
We use essential cookies to make the site work and, with your permission, Google cookies to measure traffic and show ads — including personalized ones — that keep the tools free. You can change your choice at any time under “Cookie preferences” in the footer. Learn more.
