PT-2026-50733

Name of the Vulnerable Software and Affected Versions piscina versions prior to 6.0.0-rc.2 piscina versions prior to 5.2.0 piscina versions prior to 4.9.3 Description Prototype pollution in the constructor and run paths allows an attacker to control the filename option. When the options object...

CVE-2026-48768

TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to construct public/ S3 object keys, while issuing presigned PUT URLs that do not bind Content-Type. As a result, any...

CVE-2026-48768 TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName

TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to construct public/ S3 object keys, while issuing presigned PUT URLs that do not bind Content-Type. As a result, any...

CVE-2026-54814

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109...

EUVD-2026-37709

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109...

CVE-2026-54814 WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109...

SUSE CVE-2026-24895

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP's CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...

CVE-2026-39590: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Atomlab = 2.4.5 versions...

CVE-2026-40721: Improper Control of Filename for Include/Require Statement in PHP Program

Contributor Local File Inclusion in Element Pack Pro = 9.0.6 versions...

CVE-2026-39549: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Aperitif = 1.5 versions...

CVE-2026-22338: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in EcoBlue = 1.15 versions...

CVE-2025-69174: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Etude = 1.6 versions...

CVE-2025-49403: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress = 3.0.2 versions...

CVE-2025-69150: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Medeus = 1.14 versions...

CVE-2025-69167: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Eros = 1.3 versions...

CVE-2025-69149: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Top Dog = 1.0.5 versions...

CVE-2025-69160: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Gita = 1.11 versions...

CVE-2026-34895: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Softlab Core 1.2.11 versions...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview yt-dlp is an A youtube-dl fork with additional features and patches Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via insufficient sanitization of input passed to the aria2c external...

python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters

Summary parseoptionsheader parsed Content-Disposition and Content-Type headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax filename=charset'lang'value, name=..., and the filename0/filename1 continuation form is decoded and surfaced...