CVE-2026-103507 Arbitrary file-write via log configuration path in P4Search

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account...

EUVD-2026-92299

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account...

CVE-2026-103507

Perforce P4 Search versions prior to 2026.4.2 are vulnerable to an arbitrary file-write flaw because the software fails to restrict file paths through its logging configuration interface . An attacker possessing a service authentication token can write arbitrary files to the host, which may lead ...

CVE-2026-104805 Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution

DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specific flaw exists within the backup restoration mechanism, which fai...

CVE-2026-104805

The Mitel MiVoice Office 400 system contains a vulnerability in its backup restoration functionality that allows for arbitrary file write . The flaw arises because the system fails to validate paths, file types, integrity, and authenticity of files within a TGZ archive before extraction, notably ...

CVE-2026-104805 Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution

DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specific flaw exists within the backup restoration mechanism, which fai...

CVE-2025-8110

CVE-2025-8110 — Gogs = 0.13.3 Произвольная запись файлов через обход символьных ссылок Обзор Gogs = 0.13.3 уязвим для произвольной записи файлов через API PutContents /api/v1/repos/:owner/:repo/contents/:path. API проверяет пути на последовательности обхода каталогов ../, но не разрешает...

CVE-2026-6815

CVE-2026-6815 PoC/Exploit: Casdoor 3.54.1 パストラバーサルおよび任意ファイル書き込み（認証済み） このリポジトリは、Casdoor における任意ファイル書き込みおよびパストラバーサルの脆弱性 CVE-2026-6815 の Proof of Concept PoC エクスプロイトです。 この脆弱性はバージョン 3.54.1 で 修正 されました。 Requirements 攻撃者は、Casdoor インスタンスに対して管理者権限、またはストレージプロバイダを作成・編集できる同等のユーザーとして認証されている必要があります。 Impact...

PT-2026-106247

Name of the Vulnerable Software and Affected Versions Docling versions 2.94.0 through 2.131.0 Description When users enable LatexBackendOptionstikz engine="tectonic", the system uses docling/backend/latex/engines/tectonic.py to compile TikZ bodies and document preambles without restricting TeX fi...

PT-2026-104757

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account...

CVE-2026-103507: External Control of File Name or Path

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account...

CVE-2026-103511: External Control of File Name or Path

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...

Linux Distros Unpatched Vulnerability : CVE-2026-63266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded...

CVE-2026-63266: Improper Limitation of a Pathname to a Restricted Directory

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or...

PT-2026-104813

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or...

PT-2026-106024

auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...

CVE-2026-7791

CVE-2026-7791 PoC: Привилегированный по умолчанию Исследовательское доказательство концепции для локального повышения привилегий в Amazon WorkSpaces TOCTOU + запись произвольных файлов на уровне SYSTEM в Skylight Workspace Config Service. Полные технические подробности: блог Cymulate | ---|--- CV...

CVE-2026-27876

CVE-2026-27876: Grafana SQL Expressions 임의 파일 쓰기에서 RCE까지 CVSS 9.1 Critical | 임의 파일 쓰기 | 원격 코드 실행 데모 https://github.com/user-attachments/assets/c84a4b63-7928-4dba-a069-3bafa036ce56 요약 Grafana의 SQL Expressions 기능sqlExpressions 토글은 결함이 있는 AST 허용 목록을 사용하는 프로세스 내 SQL 엔진dolthub/go-mysql-server을 사용합니다...

CVE-2025-8110

CVE-2025-8110 — Gogs 심볼릭 링크 트래버설 → RCE 개요 CVE-2025-8110 은 Gogs자체 호스팅 Git 서비스 = 0.13.3 버전의 치명적인 취약점입니다. PutContents API는 디렉터리 트래버설../에 대해 파일 경로를 검증하지만, 쓰기 전에 심볼릭 링크를 해석하지 않습니다. 인증된 사용자는 서버의 모든 파일을 대상으로 하는 심볼릭 링크가 포함된 커밋을 푸시한 다음, 해당 심볼릭 링크에 PutContents를 호출하여 실제 파일을 공격자가 제어하는 콘텐츠로 덮어쓸 수 있습니다. 이는 이전...

FortiLPE

Описание Эксплойт PoC для локального повышения привилегий для CVE-2025-62676 / EUVD-2025-206993, нацеленный на FortiClient VPN под управлением Windows. Выполняет полезную нагрузку в контексте SYSTEM из контекста обычного пользователя через произвольную запись XML-файла. PoC протестирован на...