Part-DB Part-DB-server

• CVE-2026-86055 High 8.7 Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover 0.6%
• CVE-2026-86020 Medium 4.6 Part-DB: Spreadsheet Formula Injection in XLSX Part Exports 0.2%
• CVE-2026-86019 Medium 5.3 Part-DB: Attachment Size Limit Bypass via API Base64 Upload 0.4%
• CVE-2026-86018 Medium 5.3 Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads 0.4%
• CVE-2026-59188 Medium 5.4 Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer 0.1%
• CVE-2026-55600 Medium 5.7 Part-DB: Stored HTML injection in BOM validation results via unescaped Part name 0.4%
• CVE-2026-54631 Medium 6.3 Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie 0.2%
• CVE-2026-54630 Critical 9.6 Part-DB: Authenticated RCE via .phar attachment upload served from public/media 0.3%
• CVE-2026-54615 Medium 6.0 Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) 0.4%
• CVE-2025-55194 Medium 5.7 Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload 0.4%
• CVE-2023-26042 Medium 6.1 HTML/XSS injection possibilities in Part-DB 0.5%