Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 11:47:47 +0000 EUVD-2026-274775 https://cve.radiocsirt.org/vuln/euvd-2026-274775 EUVD-2026-274775 https://cve.radiocsirt.org/vuln/euvd-2026-274775 fkie_cve-2026-28682 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28682 <p>Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user. This issue has been patched in version 2.2.3.</p> <p>Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user. This issue has been patched in version 2.2.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28682 GHSA-c36c-7pc2-f2ph — Gokapi has Data Leak in Upload Status Stream https://cve.radiocsirt.org/vuln/ghsa-c36c-7pc2-f2ph <p><strong>Affected:</strong> Go: github.com/forceu/gokapi</p> <p>## Description</p> <p>The upload status SSE implementation on `/uploadStatus` publishes global upload state to any authenticated listener and includes `file_id` values that are not scoped to the requesting user.</p> <p>## Impact</p> <p>Any authenticated user can observe other users&#39; file identifiers and retrieve unauthorized content, causing cross-tenant data exposure and loss of confidentiality for uploaded documents.</p> <p>*Issue found by [aisafe.io](https://aisafe.io)*</p> <p><strong>Affected:</strong> Go: github.com/forceu/gokapi</p> <p>## Description</p> <p>The upload status SSE implementation on `/uploadStatus` publishes global upload state to any authenticated listener and includes `file_id` values that are not scoped to the requesting user.</p> <p>## Impact</p> <p>Any authenticated user can observe other users&#39; file identifiers and retrieve unauthorized content, causing cross-tenant data exposure and loss of confidentiality for uploaded documents.</p> <p>*Issue found by [aisafe.io](https://aisafe.io)*</p> https://cve.radiocsirt.org/vuln/ghsa-c36c-7pc2-f2ph