17826 matches found
CVE-2026-103680 Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation
A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...
CVE-2026-103680 Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation
A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...
WordPress BackupSheep WordPress Backup Plugin plugin <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration vulnerability
Unauthenticated Arbitrary File Deletion and Backup Exfiltration vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin BackupSheep WordPress Backup Plugin versions = 1.8...
CVE-2026-101148 BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key
The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...
CVE-2026-101148 BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key
The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...
PT-2026-103992
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting XSS vulnerability exists in the page backup viewer admin/backup-edit.php. Page fields are correctly HTML-encoded...
CVE-2026-70650: Improper Neutralization of Input During Web Page Generation
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting XSS vulnerability exists in the page backup viewer admin/backup-edit.php. Page fields are correctly HTML-encoded...
Rocky Linux 8.6 [CIQ] Security Update: mariadb / mariadb-backup / mariadb-backup-debuginfo / etc (ciqsa-2026_0963)
The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260963 advisory. This advisory aggregates security fixes for the mariadb SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2023-24805. Tenable has extracted the preceding description...
CVE-2026-101148: External Control of File Name or Path
The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...
Rocky Linux 10.2 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2026_21380)
The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202621380 advisory. firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component CVE-2026-8388 firefox: Other issue in the JavaScript Engine component...
Backup Logs Periodically Is Not Supported for More Than One Database Engine per Job Object (Veeam Agents and Plug-ins)
Challenge When saving Guest Processing settings for a Veeam Agents backup job with periodic transaction log backup enabled for more than one database engine Microsoft SQL Server, Oracle, or PostgreSQL on the same job object, the following error occurs: Concurrent transaction log backup is not...
CVE-2026-102130
Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service...
CVE-2026-102130 Kiteworks Email Protection Gateway Remote Code Execution
Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service...
CVE-2026-102130
The Kiteworks Email Protection Gateway is vulnerable to Remote Code Execution (RCE) due to insufficient validation of uploaded backup content. An authenticated administrator can influence how the application loads these backups to execute arbitrary code on the gateway as the underlying service ac...
CVE-2026-102130 Kiteworks Email Protection Gateway Remote Code Execution
Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service...
CVE-2026-97240
Unauthenticated Sensitive Data Exposure in StifLi Backup Tools = 2.2.7 versions...
CVE-2026-97197
Unauthenticated Broken Access Control in WordPress Backup & Migration = 1.6.0 versions...
CVE-2026-97240 WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in StifLi Backup Tools = 2.2.7 versions...
