VulnCheck KEV: CVE-2026-75949

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root pathtype could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token w...

VulnCheck KEV: CVE-2026-93616

Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts...

PT-2026-96928

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description An arbitrary local file read issue exists in the Confluence and Jira upload attachment tool paths. The implementation accepts an unconstrained file path and opens the referenced server-local...

PT-2026-96763

Name of the Vulnerable Software and Affected Versions php-file-manager-with-code-editor versions prior to 3.1 Description An unrestricted file upload issue exists in the Save Handler component. A remote attacker can manipulate the filename and content arguments within the file put contents functi...

PT-2026-97116

Name of the Vulnerable Software and Affected Versions theRealSain Pixtream versions up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0 Description A security flaw exists in the processing of the '/post upload.php' endpoint. Manipulation of the media argument allows for unrestricted file upload, which...

PT-2026-96949

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description HTTP-exposed Jira and Confluence upload tools allow a remote caller to provide a file path that is passed to local file operations without being restricted to a specific workspace. This allows...

PT-2026-96903

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The Jira and Confluence attachment upload tools fail to validate file paths, allowing for path traversal. An authenticated MCP client or an AI assistant manipulated via prompt injection can...

CVE-2026-77269: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads. A caller can provide an absolute or traversal filepat...

PT-2026-96954

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The confluence upload attachment and confluence upload attachments tools do not validate that the provided source path is confined to an allowed directory before opening the file. A caller can...

PT-2026-96943

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description In multi-user HTTP deployments using the --transport streamable-http configuration, the server exposes all tools to unauthenticated network clients. This occurs because the UserTokenMiddleware...

CVE-2026-88419

WuzhiCMS version 5.0.0 is vulnerable to an unrestricted file upload via the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload). The application fails to perform content validation or use an extension allowlist, taking the file extension verbatim from the client-supplied filen...

CVE-2026-77248: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while uploadattachment accepts an unrestricted filepath. An...

CVE-2026-88738

Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An attacker with administrative privileges can upload a server-side executable file. The uploaded file is stored in a web-accessible executable location and can be...

CVE-2026-88745

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

WordPress Ultra Addons for Contact Form 7 plugin 3.2.4-3.5.50 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Jakub Herman in WordPress Plugin Ultimate Addons for Contact Form 7 versions 3.2.4-3.5.50...

writeups

Writeups & Pentest Notes Personal knowledge base documenting...

cve-2026-85706

CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read CVSS 10.0 · Unauthenticated · Actively exploited CISA KEV A parser differential between GitLab Workhorse Go reverse proxy and Puma/Grape Ruby lets an unauthenticated attacker bypass Workhorse's accelerated-upload handoff and reach three...

CVE-2026-14856-TastyIgniter

CVE-2026-14856: Stored XSS to Account Takeover in TastyIgniter v4.3.0 📌 Summary A Stored Cross-Site Scripting XSS vulnerability was identified in the file upload functionality of the Media Manager in TastyIgniter v4.3.0. Due to insufficient validation and sanitization of uploaded .svg files, an...

CVE-2026-36467

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell...

CVE-2026-94401 MISP Arbitrary Local File Read and SSRF via MISP Export Upload

MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify...