CVE-2026-57581

MediumCVSS 5.3/10Last modified Sep 30, 2026

Description

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Sep 14, 2026
Last modified: Sep 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-575833.3OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to CVE-2026-575848.7Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router register CVE-2026-575857.5MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse CVE-2026-575868.6CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync CVE-2026-575875.3A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inj CVE-2026-575883.3A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, i CVE-2026-575897.8sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-af CVE-2026-57599.8A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/dec CVE-2026-575908.1A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whe CVE-2026-575996.6There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attac CVE-2026-57609.8SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_templat CVE-2026-576007.5Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial s