Known Vulnerabilities for Download Attachments by Dfactory
Listed below are 1 of the newest known vulnerabilities associated with "Download Attachments" by "Dfactory".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-70561 json | TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, incl... | Not Provided | 2026-08-07 | 2026-08-10 |
| CVE-2026-66750 json | Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download... | Not Provided | 2026-07-28 | 2026-07-28 |
| CVE-2026-65708 json | sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attac... | Not Provided | 2026-07-24 | 2026-07-24 |
| CVE-2026-63099 json | TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that a... | Not Provided | 2026-07-17 | 2026-07-17 |
| CVE-2026-56765 json | Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with... | Not Provided | 2026-07-10 | 2026-07-10 |
| CVE-2026-55825 json | Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can reque... | Not Provided | 2026-07-31 | 2026-07-31 |
| CVE-2026-53929 json | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, with NC_SECURE_ATTACHMENTS=true, an authentica... | Not Provided | 2026-06-23 | 2026-06-25 |
| CVE-2026-53536 json | Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint ... | Not Provided | 2026-07-16 | 2026-07-18 |
| CVE-2026-52799 json | Gogs is an open source self-hosted Git service. Prior to 0.14.3, GET /attachments/:uuid returns the raw attachment file witho... | Not Provided | 2026-06-24 | 2026-06-25 |
| CVE-2026-48944 json | The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` ... | Not Provided | 2026-06-25 | 2026-06-28 |