DateAdvisorySeverity

October 2026

1 advisory

• Oct 01
  CVE-2026-102739 · type5afe

  Unsafe Deserialization on .npz dataset leads to Remote Code Execution

  Critical

July 2026

9 advisories

• Jul 31
  CVE-2026-73069 · type5afe

  SQL Injection in Twenty CRM searchVector leads to Remote Code Execution

  Critical
• Jul 23
  CVE-2026-55495 · riodrwn

  Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

  Medium
• Jul 23
  CVE-2026-55499 · riodrwn

  Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

  Medium
• Jul 23
  CVE-2026-55496 · riodrwn

  Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails

  Medium
• Jul 23
  CVE-2026-55497 · riodrwn

  Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server

  Medium
• Jul 20
  CVE-2026-59941 · riodrwn

  Uncontrolled resource consumption based on declared BMP dimensions

  Medium
• Jul 20
  CVE-2026-62326 · type5afe

  RegexCheck causes Uncontrolled Resource Consumption

  Medium
• Jul 17
  CVE-2026-63506 · riodrwn

  [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

  High
• Jul 11
  CVE-2026-55696 · eo420

  Stored XSS in Attachment Download Link via Dangerous MIME Types in PrivateBin

  Medium