agentprime: docmostEvery new CVE for docmost.https://agentprime.io/CVE-2026-48073: Docmost: Page export can include restricted same-space attachments through forged attachmentIdhttps://agentprime.io/advisories/CVE-2026-48073/https://agentprime.io/advisories/CVE-2026-48073/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 18:33:20 GMTCVECVE-2026-52853: Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNERhttps://agentprime.io/advisories/CVE-2026-52853/https://agentprime.io/advisories/CVE-2026-52853/CVSS 5.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 18:31:54 GMTCVECVE-2026-48072: Docmost: Public image fileName path traversal leads to unauthorized local file readhttps://agentprime.io/advisories/CVE-2026-48072/https://agentprime.io/advisories/CVE-2026-48072/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 18:30:57 GMTCVECVE-2026-52850: Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaceshttps://agentprime.io/advisories/CVE-2026-52850/https://agentprime.io/advisories/CVE-2026-52850/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 18:30:06 GMTCVECVE-2026-65827: Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of servicehttps://agentprime.io/advisories/CVE-2026-65827/https://agentprime.io/advisories/CVE-2026-65827/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 18:28:36 GMTCVECVE-2026-48070: Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletionhttps://agentprime.io/advisories/CVE-2026-48070/https://agentprime.io/advisories/CVE-2026-48070/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 18:15:58 GMTCVECVE-2026-40927: Docmost: XSS in Comments with JavaScript URIhttps://agentprime.io/advisories/CVE-2026-40927/https://agentprime.io/advisories/CVE-2026-40927/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 20:52:29 GMTCVECVE-2026-34213: Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validationhttps://agentprime.io/advisories/CVE-2026-34213/https://agentprime.io/advisories/CVE-2026-34213/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 21:49:55 GMTCVECVE-2026-34212: Docmost page content has stored XSS via unsanitized attachment URLshttps://agentprime.io/advisories/CVE-2026-34212/https://agentprime.io/advisories/CVE-2026-34212/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 21:42:44 GMTCVECVE-2026-33193: Docmost vulnerable to stored XSS via MIME type spoofinghttps://agentprime.io/advisories/CVE-2026-33193/https://agentprime.io/advisories/CVE-2026-33193/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 21:39:45 GMTCVECVE-2026-33146: Docmost's Public Share Search Exposes Metadata of Restricted Childrenhttps://agentprime.io/advisories/CVE-2026-33146/https://agentprime.io/advisories/CVE-2026-33146/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 21:36:53 GMTCVECVE-2026-24045: Docmost Affected by Stored XSS in Public Share Pagehttps://agentprime.io/advisories/CVE-2026-24045/https://agentprime.io/advisories/CVE-2026-24045/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 10 Feb 2026 16:56:37 GMTCVECVE-2026-23630: Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid renderinghttps://agentprime.io/advisories/CVE-2026-23630/https://agentprime.io/advisories/CVE-2026-23630/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Jan 2026 22:51:27 GMTCVECVE-2026-22249: Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)https://agentprime.io/advisories/CVE-2026-22249/https://agentprime.io/advisories/CVE-2026-22249/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Jan 2026 18:43:56 GMTCVE