https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 21:55:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-375459 EUVD-2026-375459 https://cve.radiocsirt.org/vuln/euvd-2026-375459 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54053 <p>Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user&#39;s vault and into other users&#39; vaults, including overwriting existing files. Disguised SVG content can be placed in another user&#39;s vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.</p> <p>Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user&#39;s vault and into other users&#39; vaults, including overwriting existing files. Disguised SVG content can be placed in another user&#39;s vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54053