PA
Product
Part-DB-server
9
CVEs
0
On KEV
9.6
Max CVSS
9
New 30D
Severity mix
Critical 1High 1Medium 7Low 0
Watch
Add Part-DB-server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-54630 New | 9.6 | Oct 23 | Part-DB: Authenticated RCE via .phar attachment upload served from public/media Affected: < 2.12.1 |
| CVE-2026-86055 New | 8.7 | Oct 23 | Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover Affected: < 2.13.3 |
| CVE-2026-54631 New | 6.3 | Oct 23 | Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie Affected: < 2.12.1 |
| CVE-2026-54615 New | 6.0 | Oct 23 | Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) Affected: < 2.12.1 |
| CVE-2026-55600 New | 5.7 | Oct 23 | Part-DB: Stored HTML injection in BOM validation results via unescaped Part name Affected: < 2.12.2 |
| CVE-2026-59188 New | 5.4 | Oct 23 | Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer Affected: < 2.12.3 |
| CVE-2026-86019 New | 5.3 | Oct 23 | Part-DB: Attachment Size Limit Bypass via API Base64 Upload Affected: < 2.13.2 |
| CVE-2026-86018 New | 5.3 | Oct 23 | Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads Affected: < 2.13.2 |
| CVE-2026-86020 New | 4.6 | Oct 23 | Part-DB: Spreadsheet Formula Injection in XLSX Part Exports Affected: < 2.13.2 |
Showing 9