Fluid Attacks

Latest CVEs · RSS

• CVE-2026-101947 2026-10-10 · CVSS 8.4
  ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the s
• CVE-2026-91107 2026-10-05 · CVSS 9.3
  openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Infor
• CVE-2026-102626 2026-10-02 · CVSS 7.2
  An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attrib
• CVE-2026-97685 2026-09-29 · CVSS 7.1
  An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or
• CVE-2026-85082 2026-09-24 · CVSS 8.5
  Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command.
• CVE-2026-84283 2026-09-24 · CVSS 6.8
  Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file ma
• CVE-2026-92730 2026-09-23 · CVSS 7.4
  LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.
• CVE-2026-91775 2026-09-23 · CVSS 7.4
  LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resultin
• CVE-2026-93769 2026-09-23 · CVSS 7.2
  HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users
• CVE-2026-77875 2026-09-18 · CVSS 6.8
  The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who
• CVE-2026-79954 2026-09-18 · CVSS 8.7
  NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used
• CVE-2026-77884 2026-09-14 · CVSS 7.1
  Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and ser
• CVE-2026-81301 2026-09-14 · CVSS 8.5
  Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The p
• CVE-2026-19754 2026-09-02 · CVSS 8.6
  Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula field
• CVE-2026-65931 2026-08-27 · CVSS 5.1
  LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticate
• CVE-2026-63360 2026-08-26 · CVSS 7.4
  LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. T
• CVE-2026-16809 2026-08-26 · CVSS 7.2
  LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged u
• CVE-2026-65930 2026-08-26 · CVSS 4.8
  LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrati
• CVE-2026-15973 2026-08-26 · CVSS 8.4
  LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user wi
• CVE-2026-19755 2026-08-20 · CVSS 6.9
  NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values.This issu
• CVE-2026-19198 2026-08-19 · CVSS 8.7
  Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21.
• CVE-2026-18430 2026-08-19 · CVSS 7.2
  HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's co
• CVE-2026-18756 2026-08-19 · CVSS 7.2
  HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker
• CVE-2026-18526 2026-08-19 · CVSS 7.4
  HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.
• CVE-2026-18403 2026-08-14 · CVSS 6.0
  LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey