Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| High | 8.7 | CVE-2026-86055 |
Part-DB is an open source inventory management system for electronic components
Part-DBPart-DB-server
|
NVD | |||
|
CVE-2026-86055Part-DB is an open source inventory management system for electronic components
Executive summaryPart-DB, an open source inventory management system for electronic components, has a flaw in its password reset email that lets an unauthenticated attacker take over accounts, including the built-in administrator account. The advisory rates it High severity. The advisory says the fix is to upgrade to version 2.13.3 or later, and no patch is stated as released in the advisory for versions up to 2.13.2 beyond that patched version listing. Technical summaryThe flaw is a password reset link poisoning issue caused by host header injection (CWE-640, weak password recovery). Part-DB builds the reset link in the emailed message from the client-supplied Host header, and because trusted_hosts is empty by default, any Host value is accepted, so the emailed link points to an attacker-controlled host while still containing a valid reset token. The attack needs no authentication, only the victim's username or email and network access to the public /pw_reset/request endpoint, and it requires email-based password reset to be enabled (ALLOW_EMAIL_PW_RESET=1). Affected versions are stated as less than or equal to 2.13.2 in the metadata and as less than or equal to 2.13.1 in the description, and patched versions are stated as 2.13.3 and later. Workarounds described include pinning the request context to the configured default URI and setting a non-empty TRUSTED_HOSTS allowlist, though the advisory presents these as suggested fixes rather than confirmed workarounds. Detection guidance beyond the reproduction steps is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Part-DB/Part-DB-server/secur…/GHSA-m9rf-69wp-c56r Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 4.6 | CVE-2026-86020 |
Part-DB is an open source inventory management system for electronic components
Part-DBPart-DB-server, Part-DB
|
NVD | |||
|
CVE-2026-86020Part-DB is an open source inventory management system for electronic components
Executive summaryA spreadsheet formula injection flaw in Part-DB, an open source electronic component inventory system, lets a user who can import parts store values that become live formulas when parts are exported to XLSX. The advisory rates it Moderate with a CVSS v3.1 base score of 4.6, and it says the fix is in version 2.13.2 and later. Technical summaryThis is an improper neutralization of formula elements in CSV/XLSX output (CWE-1236, with CWE-20 also listed). An authenticated user with permission to import parts can store values beginning with characters such as =, +, - or @, and when another user exports those parts to XLSX, the exporter writes them with setCellValue() so they become formula cells. The advisory says affected versions are 2.13.1 and earlier and patched versions are 2.13.2 and later. The CVSS vector given is CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The advisory does not state a workaround. It also does not state whether the flaw is exploited in the wild, and it does not give detection guidance beyond the proof of concept. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Part-DB/Part-DB-server/secur…/GHSA-hxw4-frfg-f8jw Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-86019 |
Part-DB is an open source inventory management system for electronic components
Part-DBPart-DB-server, Part-DB
|
NVD | |||
|
CVE-2026-86019Part-DB is an open source inventory management system for electronic components
Executive summaryPart-DB, an open source inventory management system for electronic components, has a flaw that lets an authenticated API user upload attachments larger than the configured maximum size. This could fill up server disk space and cause a denial of service for other users. The advisory rates it Low, and the affected versions are 2.13.1 and earlier, with a patched version of 2.13.2 or later. Technical summaryThe weakness is uncontrolled resource consumption (CWE-400 and CWE-770) in the attachment API. The base64 upload path in AttachmentSubmitHandler::handleUpload() does not enforce the MAX_ATTACHMENT_FILE_SIZE limit that applies to browser uploads, so an authenticated user with API access and attachment-creation permission can store oversized files. The advisory includes a proof of concept that stored a 5 MB file with the limit set to 1M, returning HTTP 201. Affected versions are stated as <=2.13.1 and patched versions as 2.13.2+. The advisory does not state any workaround. It does not state whether the issue is exploited in the wild, and it gives no CVSS score beyond the Low severity label. No specific detection guidance is provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Part-DB/Part-DB-server/secur…/GHSA-8fvw-xrgv-jq4w Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-86018 |
Part-DB is an open source inventory management system for electronic components
Part-DBPart-DB-server, Part-DB
|
NVD | |||
|
CVE-2026-86018Part-DB is an open source inventory management system for electronic components
Executive summaryPart-DB, an open source inventory management system for electronic components, has a flaw that lets a logged-in user make the server download remote attachment files larger than the configured maximum size, which can fill up the disk. The advisory rates it Low severity. The fix is to upgrade Part-DB to version 2.13.2 or later. Technical summaryThis is an uncontrolled resource consumption flaw (CWE-400, CWE-770) in the server-side "Download external file" attachment feature. When server-side attachment downloads are enabled, the downloadURL() method streams the remote response body to disk without checking the Content-Length header or counting bytes, so the MAX_ATTACHMENT_FILE_SIZE limit is bypassed. The attacker needs an authenticated account that can create or edit attachments, and the feature must be enabled (for example via ALLOW_ATTACHMENT_DOWNLOADS=1). Affected versions are stated as <=2.13.1 and patched versions as 2.13.2+. The advisory does not state a CVSS score or any workaround beyond disabling the feature implicitly through its settings. Exploitation in the wild is not stated, and detection guidance beyond the proof of concept is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Part-DB/Part-DB-server/secur…/GHSA-2whx-2cx7-qvq6 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.4 | CVE-2026-59188 |
Part-DB is an open source inventory management system for electronic components
Part-DBPart-DB-server, Part-DB
|
NVD | |||
|
CVE-2026-59188Part-DB is an open source inventory management system for electronic components
Executive summaryPart-DB, an open source inventory management system for electronic components, has a stored cross-site scripting flaw in its attachment viewer. An authenticated user with upload permission can plant a script that runs in the browsers of other users, including administrators. The advisory rates it Moderate with a CVSS v3.1 base score of 5.4 and says the issue is fixed in version 2.12.3. Technical summaryThe flaw is CWE-79 (cross-site scripting) combined with CWE-434 (unrestricted upload of dangerous file type). SVG sanitization is chosen by the user-supplied original filename extension rather than file content, so an SVG renamed to a non-SVG extension such as .jpg skips sanitization, and the content-type handling only downgrades text/html, so the file is served inline as image/svg+xml. The attack requires an authenticated user with attachment upload permission and a victim who opens the attachment view URL (user interaction required); CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Affected versions are stated as <= 2.12.2 and the patched version is 2.12.3. The advisory gives a fix recommendation (magic-byte MIME detection, extension matching, XML-aware SVG sanitizing) but does not state a workaround. Detection guidance and in-the-wild exploitation status are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Part-DB/Part-DB-server/secur…/GHSA-2vhp-c958-m47j Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.7 | CVE-2026-55600 |
Part-DB is an open source inventory management system for electronic components
Part-DBPart-DB-server, Part-DB
|
NVD | |||
|
CVE-2026-55600Part-DB is an open source inventory management system for electronic components
Executive summaryA stored HTML injection flaw exists in Part-DB, an open source inventory management system, in its BOM validation results page. One user can store HTML in a Part name that is then rendered inside another user's validation page after a BOM import. The advisory rates it Moderate and says the affected versions are 2.12.1 and earlier, with the fix in 2.12.2 and later. Technical summaryThe flaw is CWE-79 cross-site scripting, specifically stored HTML injection, caused by the BOM validation template rendering messages with the Twig raw filter while they contain user-controlled Part names. The attacker needs permission to create or edit a Part name, and the victim needs permission to import a BOM into a Project; the advisory says the issue was reproduced with two Editor-preset users. The advisory states that the affected versions are <= 2.12.1 and the patched versions are 2.12.2+. The advisory says the current Content Security Policy appears to block inline JavaScript, but arbitrary HTML such as links, forms, and images can still be injected. Suggested fixes are to remove the raw filter or escape placeholders before interpolation. No workaround is stated, and no CVSS score or exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Part-DB/Part-DB-server/secur…/GHSA-qqrh-jjhg-vv5r Impact if exploitedConfidentialityNone IntegrityHigh AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.3 | CVE-2026-54631 |
Part-DB is an open source inventory management system for electronic components
Part-DBPart-DB-server, Part-DB
|
NVD | |||
|
CVE-2026-54631Part-DB is an open source inventory management system for electronic components
Executive summaryPart-DB, an open source inventory management system for electronic components, ships with a fixed secret value committed in its repository, which the advisory says the official Docker image uses unless the operator overrides it. An attacker who knows this value can forge login cookies and gain an authenticated session, including as an admin, without a password. The advisory rates the issue Moderate with a CVSS 3.1 base score of 6.3, and the fix is to upgrade to version 2.12.1 or later. Technical summaryThis is a use of hard-coded credentials (CWE-798) in which the APP_SECRET value in the committed .env file is used as the HMAC key for Symfony remember-me cookies. The advisory describes two attack paths: full offline forgery using a target's bcrypt hash obtained from a database dump or SQL injection, and cookie extension using a single intercepted REMEMBERME cookie from any user. Affected versions are stated as <=2.12.0 and patched versions as 2.12.1+. The CVSS vector given is AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L. The advisory does not state a workaround beyond overriding APP_SECRET, does not state whether exploitation has been observed in the wild, and does not give detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Part-DB/Part-DB-server/secur…/GHSA-99pw-2v29-v4wc Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityLow
How it is exploited
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Critical | 9.6 | CVE-2026-54630 |
Part-DB is an open source inventory management system for electronic components
Part-DB, jbtronicsPart-DB-server, jbtronics part-db1
|
NVD | |||
|
CVE-2026-54630Part-DB is an open source inventory management system for electronic components
Executive summaryPart-DB, an open source inventory management system for electronic components, has a critical flaw in versions 2.12.0 and earlier. Any logged-in user in the default users group can upload a file that the server then runs as code, which could let them take over the whole instance. The advisory says the fix is to update to version 2.12.1 or later. Technical summaryThis is an unrestricted file upload (CWE-434) that leads to remote code execution. The attachment upload handler saves files under the public media directory using the client-supplied extension, and its blocklist rewrites several dangerous extensions but omits .phar, so a .phar file is stored and executed by PHP-FPM when requested. The attacker needs an authenticated account in the default users group, and the advisory says no victim interaction is required. Affected versions are stated as <= 2.12.0, with patched versions 2.12.1+. The advisory describes the CVSS v3.1 vector as AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N with a score of 9.6. No workaround is stated beyond the patch, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Part-DB/Part-DB-server/secur…/GHSA-w5m7-3xf7-6g7g Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.0 | CVE-2026-54615 |
Part-DB is an open source inventory management system for electronic components
Part-DBPart-DB-server, Part-DB
|
NVD | |||
|
CVE-2026-54615Part-DB is an open source inventory management system for electronic components
Executive summaryPart-DB, an open source inventory management system for electronic components, has a stored cross-site scripting flaw. A low-privileged user with edit rights can plant malicious markup that runs in the browser of a higher-privileged user who views the activity log or element history. The advisory says the issue is patched in version 2.12.1, and the recommended step is to upgrade to that version or later. Technical summaryThe flaw is stored cross-site scripting (HTML injection) in LogEntryExtraFormatter, where the CollectionElementDeleted branch interpolates the deleted sub-element's name into HTML without htmlspecialchars() escaping, unlike the other branches. An attacker needs edit rights on the owning element to set the sub-element name, then deletes it to write the log entry, and a higher-privileged viewer with system.show_logs or access to the element history then renders the markup. The advisory states that Content Security Policy normally blocks inline JavaScript execution, which limits impact. Affected versions are stated as prior to 2.12.1, and the fix is in 2.12.1. No workaround is stated. No detection guidance is stated, and whether the issue is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploitedConfidentialityNone IntegrityHigh AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||