https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 17:24:44 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-54053 <p>Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user&#39;s vault and into other users&#39; vaults, including overwriting existing files. Disguised SVG content can be placed in another user&#39;s vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.</p> <p>Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user&#39;s vault and into other users&#39; vaults, including overwriting existing files. Disguised SVG content can be placed in another user&#39;s vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-54053