CVE-2026-67200 is a path traversal vulnerability in Perspective 5.0.0 that allows unauthenticated remote attackers to read arbitrary files from the server filesystem. The vulnerability is caused by insufficient query-string-stripping sanitization, which enables attackers to bypass security measures and retrieve sensitive files. This vulnerability has a high CVSS score of 8.7 and is considered HIGH severit [truncated]
CVE-2026-67199 is a denial of service vulnerability in Perspective 5.0.0 that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. This vulnerability can cause the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unrespon [truncated]
CVE-2026-67198 is a high-severity denial-of-service vulnerability in Perspective 5.0.0's VirtualServer protocol dispatcher. Unauthenticated remote attackers can crash the server process by sending malformed or incomplete protobuf messages. The vulnerability is triggered by well-formed requests with missing fields, causing the process to abort with SIGABRT. Defenders should assess exposure, prioritize reme [truncated]
CVE-2026-67196 is a cross-site scripting vulnerability in Perspective 5.0.0's built-in Debug plugin. Attackers can inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup. This occurs because angle brackets and event handler attributes are never escaped before assignment, causing malicious scripts to execute in the embedding page's origin. The vulnerability has a [truncated]
CVE-2026-67195 is a remote code execution vulnerability in Perspective 5.0.0 that allows unauthenticated attackers to execute arbitrary operating system commands. The vulnerability is caused by the PolarsVirtualServer backend passing client-supplied input directly to Python's eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal to reach subprocess.Popen and ach [truncated]
