Part-db Part-db-server vulnerabilities

• part-db part-db-server Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover CVE-2026-86055 8.7 HighOctober 23, 2026
• part-db part-db-server Part-DB: Spreadsheet Formula Injection in XLSX Part Exports CVE-2026-86020 4.6 MediumOctober 23, 2026
• part-db part-db-server Part-DB: Attachment Size Limit Bypass via API Base64 Upload CVE-2026-86019 5.3 MediumOctober 23, 2026
• part-db part-db-server Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads CVE-2026-86018 5.3 MediumOctober 23, 2026
• part-db part-db-server Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer CVE-2026-59188 5.4 MediumOctober 23, 2026
• part-db part-db-server Part-DB: Stored HTML injection in BOM validation results via unescaped Part name CVE-2026-55600 5.7 MediumOctober 23, 2026
• part-db part-db-server Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie CVE-2026-54631 6.3 MediumOctober 23, 2026
• part-db part-db-server Part-DB: Authenticated RCE via .phar attachment upload served from public/media CVE-2026-54630 9.6 CriticalOctober 23, 2026
• part-db part-db-server Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) CVE-2026-54615 6.0 MediumOctober 23, 2026
• part-db project part-db, part-db part-db-server +1 more Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload CVE-2025-55194 5.7 MediumAugust 13, 2025
• part-db project part-db, part-db part-db-server +1 more HTML/XSS injection possibilities in Part-DB CVE-2023-26042 6.1 MediumFebruary 27, 2023