CVE-2026-76806
Description détaillée
Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\TemporaryDirectory\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0.
Vecteur d'attaque (CVSS)
Dernières Vulnérabilités
CVE-2026-97377
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata and sensitive records, affect query behavior, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-94395
A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may cause a denial of service or potentially arbitrary code execution with the privileges of the affected process. Affected releases start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449).
CVE-2026-71550
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. The affected flow begins at modules/AOW_WorkFlow/controller.php and uses aow_action, and require_once() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with the WorkFlow role can include executable PHP, obtain server-side code execution, access CRM data and configuration secrets, and establish persistent access. This issue is fixed in versions 7.15.2 and 8.10.2.