https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 15:16:16 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110774 <p>Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users&#39; private attachments due to a flawed owner check. Attackers can supply another user&#39;s stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.</p> <p>Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users&#39; private attachments due to a flawed owner check. Attackers can supply another user&#39;s stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.</p> https://db.gcve.eu/vuln/fkie_cve-2026-110774 https://db.gcve.eu/vuln/ghsa-62f6-6f4g-pr5m <p>Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users&#39; private attachments due to a flawed owner check. Attackers can supply another user&#39;s stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.</p> <p>Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users&#39; private attachments due to a flawed owner check. Attackers can supply another user&#39;s stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.</p> https://db.gcve.eu/vuln/ghsa-62f6-6f4g-pr5m