📦 Hotcrp

CVE-2026-23836 is a critical remote code execution vulnerability in HotCRP conference review software. It allows authenticated users to execute arbitrary PHP code through inadequately sanitized formul...

HotCRP conference review software versions from October 2025 through January 2026 incorrectly delivered all document types with inline Content-Disposition, causing them to render in browsers instead o...

This vulnerability in HotCRP conference review software allows authors with at least one submission to download any documents (PDFs, attachments) from any submission on the site, bypassing intended ac...