CVE-2026-71379
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.
CVSS
10.0
Critical
EPSS
0.4%
p37
KEV
—
Exploit Today
11
0-100
Published: Sep 29, 2026 · Last modified: Sep 29, 2026 · CWE-552
0.4%EPSS · 30 days0.4%
2026-09-302026-10-19
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1129486.5 MED—
———Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.14hCVE-2026-1121445.3 MED—
——0A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessible. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.2dCVE-2026-1026958.2 HIG21.9%
——7OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.1dCVE-2026-108070—37.7%
——11A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.6dCVE-2026-968575.5 MED31.5%
——9Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally.1dCVE-2026-881376.5 MED60.7%
——18Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network.5d