Vulnerabilities

TI-2026-46826 CVE-2026-65690 · GHSA-42mq-p2mg-jgxc

Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload

MEDIUM 41

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00901 Published 2026-07-23 Fixed in 14.1.12 CWE-22

TI-2026-46825 CVE-2026-65689 · GHSA-qw66-8h8f-7phh

Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download

MEDIUM 50

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server f…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00866 Published 2026-07-23 Fixed in 14.1.12 CWE-22

TI-2026-46824 CVE-2026-65688 · GHSA-mx5r-8grf-ph62

Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Font Processing

MEDIUM 50

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated attackers to read arbitrary files from the server fil…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00866 Published 2026-07-23 Fixed in 14.1.12 CWE-22

TI-2026-46823 CVE-2026-65687 · GHSA-hcq3-wvr8-3wvg

Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processing

MEDIUM 50

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server file…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00866 Published 2026-07-23 Fixed in 14.1.12 CWE-22

TI-2026-13878 CVE-2026-16630 · GHSA-8vqr-xp4f-pr6m

syncfusion ej2-javascript-ui-controls package.json child_process.exec os command injection

MEDIUM 55

A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.01083 Published 2026-07-22 No fix listed CWE-77

TI-2025-39267 CVE-2025-63260 · GHSA-33x6-3h2c-p4c7

SyncFusion 30.1.37 is vulnerable to Cross Site Scripting (XSS) via the Document-Editor…

LOW 24

SyncFusion 30.1.37 is vulnerable to Cross Site Scripting (XSS) via the Document-Editor reply to comment field and Chat-UI Chat message.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00166 Published 2026-03-20 No fix listed CWE-79

TI-2023-11699 CVE-2023-26564 · GHSA-cgh5-9m3c-c3qx

The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to…

HIGH 82

The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01731 Published 2023-07-12 No fix listed CWE-22

TI-2023-11698 CVE-2023-26563 · GHSA-cx4w-jxx7-pvcg

The Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js…

HIGH 82

The Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js directory traversal.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01902 Published 2023-07-12 No fix listed CWE-22

Vulnerabilities

Filters