CVE-2026-92919

admin3 versions through 3.0.0 are affected by an arbitrary file write vulnerability in the storage upload handler . The application fails to sanitize client-supplied filenames, allowing authenticated (low-privilege) users to inject dot-dot path traversal segments that escape the configured storag...

EUVD-2026-81574

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

CVE-2026-92919 admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

CVE-2026-92919 admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

CVE-2026-88795 wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...

CVE-2026-88795 wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...

CVE-2026-88795

The wpShopGermany IT-RECHT KANZLEI WordPress plugin (versions before 2.4 ) contains a vulnerability where it fails to generate API authentication tokens securely. The plugin derives these tokens from data controlled by the requester and creates them as a side effect of the validation check. This ...

PT-2026-94388

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.18 Description The save file endpoint in the File Manager, used by the Query Tool and ERD, contains a race condition. While the system validates the requested path using the check access permission function, it...

PT-2026-95020

Name of the Vulnerable Software and Affected Versions Many Notes versions prior to 0.16.0 Description The ZIP vault import feature in the app/Actions/ProcessImportedVault.php file allows archive filenames to contain parent-directory traversal segments. This enables an authenticated user to write...

CVE-2026-88795: Improper Control of Generation of Code

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...

CVE-2026-54583: Improper Limitation of a Pathname to a Restricted Directory

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry-bundlefile, an...

CVE-2026-92919: Improper Limitation of a Pathname to a Restricted Directory

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

PT-2026-95144

Name of the Vulnerable Software and Affected Versions Vvveb versions 1.0.0 through 1.0.8.4 Description An authenticated user with the Editor role and editor/ permission can perform a path traversal attack. The saveGlobalElements function in admin/controller/editor/global-trait.php improperly...

PT-2026-95024

Name of the Vulnerable Software and Affected Versions Verizon Cloud for Android versions prior to 26.7.10 Description A path traversal issue exists where co-resident malicious applications can write attacker-controlled bytes outside the intended staging directory. This occurs due to unsanitized...

CVE-2026-92970: Improper Limitation of a Pathname to a Restricted Directory

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen pat...

CVE-2026-54053: Improper Limitation of a Pathname to a Restricted Directory

Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside...

PT-2026-95004

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager fails to consistently reject bundle filenames that are empty or contain dots, dot-dot sequences, or slashes within the libmport/fetch.c file. This occurs because the is...

CVE-2026-86861: Time-of-check Time-of-use (TOCTOU) Race Condition

pgAdmin 4's File Manager savefile endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.checkaccesspermission and then opened the file for writing with a plain open call. CVE-2026-7819 had previously hardened the separate file upload path by openi...

CVE-2026-89038: Improper Limitation of a Pathname to a Restricted Directory

Verizon Cloud for Android com.vcast.mediamanager before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted displayname value containing path-traversal...

CVE-2026-15815: Improper Link Resolution Before File Access

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory...