Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 07:43:50 +0000 EUVD-2026-371336 https://cve.radiocsirt.org/vuln/euvd-2026-371336 EUVD-2026-371336 https://cve.radiocsirt.org/vuln/euvd-2026-371336 fkie_cve-2026-63765 https://cve.radiocsirt.org/vuln/fkie_cve-2026-63765 <p>Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application&#39;s storage backend.</p> <p>Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application&#39;s storage backend.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-63765 GHSA-9wjj-m9cm-hjjc https://cve.radiocsirt.org/vuln/ghsa-9wjj-m9cm-hjjc <p>Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application&#39;s storage backend.</p> <p>Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application&#39;s storage backend.</p> https://cve.radiocsirt.org/vuln/ghsa-9wjj-m9cm-hjjc