CVE-2026-52835

Tautulli , a Python-based monitoring and tracking tool for Plex Media Server, is affected by a path traversal / arbitrary file write vulnerability prior to version 2.17.2 . The flaw exists in the import_config handler and the database_file branch of import_database in plexpy/webserve.py, where an...

CVE-2026-94383

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...

CVE-2026-94383 MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...

CVE-2026-94383

MISP versions prior to 2.5.47 are affected by an arbitrary code execution vulnerability in the blocklist workflow module . The module accepted a user-supplied blocklist filename parameter without validating the file extension, applying only basename() to strip path components and a check for empt...

CVE-2026-88857 Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla 6.2.7 - The extensions saveWatermark copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension chec...

CVE-2026-88857 Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla 6.2.7 - The extensions saveWatermark copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension chec...

CVE-2026-94037

A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affects the function ControlFlowNode of the file main.py of the component analyzecsvdata MCP tool. This manipulation of the argument filename causes path traversal. Remote...

EUVD-2026-83753

A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affects the function ControlFlowNode of the file main.py of the component analyzecsvdata MCP tool. This manipulation of the argument filename causes path traversal. Remote...

CVE-2026-94037

CVE-2026-94037 affects the mcp-file-analyzer project (by 00Kisumi00) up to commit 84740852 . The vulnerability is a path traversal in the ControlFlowNode function within main.py , part of the analyze_csv_data MCP tool. An attacker can manipulate the filename argument to traverse beyond the intend...

CVE-2026-94037 00Kisumi00 mcp-file-analyzer analyze_csv_data MCP tool main.py ControlFlowNode path traversal

A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affects the function ControlFlowNode of the file main.py of the component analyzecsvdata MCP tool. This manipulation of the argument filename causes path traversal. Remote...

SUSE CVE-2026-49147

App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a...

PT-2026-95739

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.09.003 Description Authenticated users with subscriber-level access and above can achieve Remote Code Execution via the wppa image magick function. The issue stems from insufficient sanitization of the...

CVE-2026-84071

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in...

CVE-2026-81937

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelogconfig file CLI command. A highly privileged authenticated user can inject shell commands through the filename parameter, potentially resulting in arbitrary command execution with root...

CVE-2026-84071

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can supply a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in arbit...

EUVD-2026-83309

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelogconfig file CLI command. A highly privileged authenticated user can inject shell commands through the filename parameter, potentially resulting in arbitrary command execution with root...

CVE-2026-81937 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelogconfig file CLI command. A highly privileged authenticated user can inject shell commands through the filename parameter, potentially resulting in arbitrary command execution with root...

CVE-2026-81937 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelogconfig file CLI command. A highly privileged authenticated user can inject shell commands through the filename parameter, potentially resulting in arbitrary command execution with root...

[SECURITY] [DLA 4785-1] zip security update

Debian LTS Advisory DLA-4785-1 [email protected] https://www.debian.org/lts/security/ Andreans Henriksson September 18, 2026 https://wiki.debian.org/LTS Package : zip Version : 3.0-13+deb12u1 CVE ID : CVE-2018-13410 Debian Bug : 903196 1005943 1077054 1093629 1143866 Multiple minor...

CVE-2026-16777

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...