CVE-2026-71284: Improper Neutralization of Special Elements used in an OS Command

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

CVE-2026-7693: Improper Neutralization of Special Elements used in a Command

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the file POST parameter on the restoreBackup AJAX handler. The handler applies escattr — an HTML-context sanitizer that does not strip...

vCenter Server or ESXi Host Becomes Unavailable After Its TLS Certificate Is Replaced

Challenge A VMware vSphere server becomes unavailable in Veeam Backup & Replication after the TLS certificate installed on that server has been replaced or renewed. Jobs and other operations that require a connection to that server fail while the server is unavailable. Cause This issue occurs...

Standalone Veeam Agent for Unix Fails to Connect to Veeam Backup Server After Certificate Changed Twice

Challenge Veeam Agent for IBM AIX or Veeam Agent for Oracle Solaris operating in standalone mode is unable to connect to its configured Veeam Backup Server. Backup jobs fail to start, and attempts to resynchronize or edit the connection fail with the following error: Self-signed certificate This...

CVE-2026-70592

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

Ghost: Database Backup Path Traversal

Impact An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues. Vulnerable versions This vulnerability is present in Ghost from 1.20.1 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For...

GHSA-CJ62-HVV2-2Q5H Ghost: Database Backup Path Traversal

Impact An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues. Vulnerable versions This vulnerability is present in Ghost from 1.20.1 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For...

Directory Traversal

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Directory Traversal in the database backup and export filename handling through the backup/export filename processing in the admin backend and exporter modules. An administrator-level attacker can overwrit...

NPM: Ghost: Database Backup Path Traversal

NPM: Ghost: Database Backup Path Traversal vulnerability discovered by ? in WordPress Npm ghost versions = 1.20.1, 6.54.1...

CVE-2026-70592 Ghost: Database Backup Path Traversal

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

CVE-2026-70592 Ghost: Database Backup Path Traversal

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

CVE-2026-70592 Ghost: Database Backup Path Traversal

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

CVE-2026-70592

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

CVE-2026-70592

Ghost is a Node.js content management system. In versions 1.20.1 through 6.54.1, an Administrator-level user could remotely overwrite certain filesystem files via the database backup filename because the database export endpoint did not reject path separators in the caller-supplied filename. This...

WordPress Backup Migration plugin <= 2.1.1 - Authenticated (Administrator+) OS Command Injection vulnerability

Authenticated Administrator+ OS Command Injection vulnerability discovered by at1as in WordPress Plugin Backup Migration versions = 2.1.1...

Le Panthéon de la Souveraineté — Updated!

🏠 Developed on: GitLab | 🪞 Automated mirror on: GitHub 🏛️ The Pantheon of Sovereignty A 100% sovereign, redundant and secure cloud infrastructure, designed to completely break free from GAFAM. Version 1.1: Private network foundation, DNS request encryption for servers DoT and multi-datacenter...

CVE-2026-18759

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

CVE-2026-18759

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

CVE-2026-18759 An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

CVE-2026-18759

CVE-2026-18759 affects ASUSTOR Backup Plan (ABP) and ASUSTOR EZ Sync (AES): a file-based IPC protected by AES can be abused by a local authenticated user to recover the IPC key (readable by standard users, DPAPI-protected) and forge IPC requests. Combined with an insufficient substring check for ...