PT-2026-89494

Warning: A critical path traversal vulnerability in Plesk Backup Manager allows arbitrary root file writes by authenticated customers. CVE-2026-68487 CVSS3.0: 9.9. Read the advisory https://t.co/GniZ2f5Oox and Patch Patch Patch...

PT-2026-89446

Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration = 2.4.2 versions...

PT-2026-89260

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK EDITOR permission to plant a VQL...

CVE-2026-8044

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

EUVD-2026-75097

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

CVE-2026-8044

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

CVE-2026-8044

CVE-2026-8044 is a CWE-88 (Argument Injection) vulnerability in Schneider Electric software, enabling remote code execution when a privileged attacker supplies malicious arguments as backup configuration parameters . The CVSS 4.0 score is 8.6 (HIGH) , with low attack complexity and no user intera...

CVE-2026-8044

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

Improper Cleanup on Thrown Exception

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Improper Cleanup on Thrown Exception through the restore process. An attacker can cause permanent data loss by uploading a corrupted or invalid backup archive, resulting in...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

CVE-2026-86748

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-86748 Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-86748

Snipe-IT versions before 8.7.0 contain a vulnerability in the restore endpoint where the database is wiped before the uploaded backup archive is validated. A superuser uploading a corrupted or invalid zip file triggers permanent data loss with no recovery path or rollback mechanism. The CVSS 3.1 ...

EUVD-2026-74925

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-86748 Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-86748 Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

WordPress ZHBackup – Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ZHBackup – Backup, Restore & Migration versions = 2.4.2...

PT-2026-89083

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

CVE-2026-8044: Improper Neutralization of Argument Delimiters in a Command

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

CVE-2026-86748: Improper Cleanup on Thrown Exception

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...