https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T11:49:47.542103+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-42564 CVE-2026-42564 — jotty·page: Unauthenticated Path Traversal leads to sensitive file disclosure and session-token reuse impact 2026-10-08T11:49:47.543200+00:00

Affected: fccview jotty

jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.