CVE-2026-14925 Import WP < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...

CVE-2026-14925

The Import WP WordPress plugin, in versions prior to 2.14.23 , is vulnerable to unauthenticated sensitive information exposure due to a lack of authorization checks on an export-file download handler. An unauthenticated attacker could potentially download export files generated by administrators,...

django-cms-qe (1.4.3), django-import-export (2.0.1) +1 more potentially affected by CVE-2026-9318 via tablib (0.14.0)

tablib PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on tablib and may be impacted: - django-cms-qe 1.4.3 - django-import-export 2.0.1 - iambic 1.0.0 Source cves: CVE-2026-9318 Source advisory: OSV:GHSA-GQGW-JGHV-MXWX...

PT-2026-71006

Name of the Vulnerable Software and Affected Versions Import WP WordPress plugin versions prior to 2.14.23 Description An authorization check is missing in an export-file download handler, which allows unauthenticated attackers to download export files created by administrators. These files may...

PT-2026-71353

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description A buffer overflow exists in the IXF IMPORT parser. A buffer overflow occurs when a program writes more data to a block of memory, or buffer, than it is...

PT-2026-71126

Name of the Vulnerable Software and Affected Versions Apache Airflow version 3.3.0 Description Insecure deserialization in the Apache Airflow Scheduler allows for arbitrary module import, which can lead to remote code execution. Deserialization is the process of converting a data format back into...

PT-2026-71046

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

PT-2026-71322

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration...

PT-2026-71306

Name of the Vulnerable Software and Affected Versions LXD affected versions not specified Description A link following flaw allows an attacker to perform arbitrary file read and write operations on the host system. The issue occurs during the import or unpacking of an image archive because the...

CVE-2026-67587: Deserialization of Untrusted Data

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

CVE-2026-14925: Exposure of Sensitive Information to an Unauthorized Actor

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...

CVE-2026-13105: Improper Limitation of a Pathname to a Restricted Directory

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration...

CVE-2026-67260: Deserialization of Untrusted Data

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaitinginput task state swept by the scheduler. That sweep deserializes the task instance's nextkwargs without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an...

pgAdmin 4 Import/Export Data Command Execution

The vulnerability of the Import/Export Data function of the pgAdmin 4 database management tool is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands on the server remotely...

CVE-2026-10534: Stack-based Buffer Overflow

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser...

PT-2026-71308

Name of the Vulnerable Software and Affected Versions LXD affected versions not specified Description A path traversal vulnerability exists during backup import and restore operations. The issue occurs because the software fails to validate instance and storage volume names within the archive...

CVE-2026-66898: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...

GO-2026-5576 LXD: Importing a crafted backup leads to project restriction bypass in github.com/canonical/lxd

LXD: Importing a crafted backup leads to project restriction bypass in github.com/canonical/lxd...

CVE-2026-73248

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

CVE-2026-46670 YesWiki: Unauthenticated SQL Injection

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path FormManager::create allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an INSERT statement and read the full database, includin...