Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: restore set elements when delete set fails From the abort path, nftmapelemactivate needs to restore refcounters to their original state. Currently, it uses set-ops-walk to iterate over these set elements. The...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/restrack: The MR restrack must be released when it is deleted. The MR restrack also needs to be released when it is deleted; otherwise, a memory leak may occur, as the task struct will not be released...

WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mamgad in WordPress Plugin Delete All Comments of wordpress versions = 7.1...

CVE-2026-104810

This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this vulnerability. The specific flaw exists within the web portal listening on TCP port 443, under Maintenance → File Management →...

CVE-2026-104810

Mitel MiVoice Office 400 is affected by a path traversal vulnerability in the web portal (TCP port 443) specifically within the Maintenance → File Management → File Browser section. An authenticated attacker can exploit this flaw to access and delete sensitive files outside the intended directory...

CVE-2026-104810 Mitel MiVoice Office 400 File Management File Browser path traversal vulnerability

This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this vulnerability. The specific flaw exists within the web portal listening on TCP port 443, under Maintenance → File Management →...

CVE-2026-0603

CVE-2026-0603 Inyección en Hibernate ORM / Inyección SQL de Segundo Orden ★ CVE-2026-0603 PoC de Inyección SQL en Hibernate ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Descripción general CVE-2026-0603 es una vulnerabilidad de Inyección SQL de Segundo Orden e...

CVE-2017-20285

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on th...

CVE-2017-20285

YAML versions before 1.30 for Perl are vulnerable to a flaw where a loaded document can trigger the DESTROY method of arbitrary classes. The vulnerability occurs because a perl/hash:Class tag blesses a hash into a class named in the document; when the object goes out of scope, Perl executes its d...

CVE-2017-20285 YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on th...

CVE-2020-14883

http://myq-x.remore:8090/index.php?m=WebServiceMgmt::invoke&p="d":"\\m\":"Wsf\\\\Win\\\\Firewall::delete\","\\p\":"----\\\"|ipconfig+/allC:\\\\Windows\\\\system32\\\\spool\\\\drivers\\\\1.txt||----","\\id\":"1","\\pwd\":"","s":"b75c29ef4a5a3d600d96732b3c5cbed1"...

EUVD-2026-92157

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2026-105293

Legcord versions 1.1.0 through 1.3.0 are vulnerable to a path traversal vulnerability within the theme IPC handlers. The root cause is the use of unvalidated theme ids , which allows scripts running in the Discord origin (e.g., via XSS ) to escape the designated themes directory. Attackers can ab...

CVE-2026-105293 Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2026-105293: Improper Limitation of a Pathname to a Restricted Directory

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2026-95264: Undefined Security Weakness

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

CVE-2026-105687: Improper Privilege Management

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...

PT-2026-106208

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description An issue exists in the delete-team-member RPC where a team administrator can remove any member except themselves, but the system fails to protect the team owner. This allows a non-owner administrator...

EUVD-2026-92782

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

CVE-2026-105680: Missing Authorization

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0...