CVE-2026-100389 GestSup before 3.2.62 Remote Code Execution via IMAP Attachment

GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible...

CVE-2026-100389 GestSup before 3.2.62 Remote Code Execution via IMAP Attachment

GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible...

EUVD-2026-72555

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools...

CVE-2026-48482 GLPI: RCE via Form import

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location...

DEBIAN-CVE-2026-67223

RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes $username into userdnpattern without RFC 4514 DN escaping, allowing a...

AZL-105305 CVE-2026-67223 affecting package rabbitmq-server 3.13.7-9

RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes $username into userdnpattern without RFC 4514 DN escaping, allowing a...

CVE-2026-67223

RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes $username into userdnpattern without RFC 4514 DN escaping, allowing a...

CVE-2026-67223

RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes $username into userdnpattern without RFC 4514 DN escaping, allowing a...

CVE-2026-100230

Input Leap aka input-leap through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message...

CVE-2026-67223

RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes $username into userdnpattern without RFC 4514 DN escaping, allowing a...

EUVD-2026-87156

RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes $username into userdnpattern without RFC 4514 DN escaping, allowing a...

CVE-2026-67223

The messaging and streaming broker RabbitMQ is vulnerable to an LDAP injection flaw because the fill/2 function substitutes ${username} into user_dn_pattern without proper RFC 4514 DN escaping . A crafted username can alter the LDAP bind DN , potentially allowing an attacker to select a different...

Exploit for Path Traversal in Vmware Vcenter_Server

CVE-2026-59310 – VMware vCenter Syslog Directory Traversal Lea...

ROOT-APP-GOBINARY-CVE-2026-56865 CVE-2026-56865 in golang.org/x/mod - Patched by Root

Root has patched CVE-2026-56865 in the golang.org/x/mod package for Root:Go. Multiple fixed versions available...

CVE-2026-42322 Piwigo: Authenticated RCE via File Upload in Logo Upload Feature

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themesstandardpages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from stdpgslogo when constructing the stored filename. An authenticated administrat...

CVE-2026-50547

The self-hosted open source application InvoicePlane (versions prior to 1.7.2 ) is vulnerable to Local File Inclusion (LFI) . The root cause is located in the Invoices::generate_xml() method, which appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP...

CVE-2026-100230

The software Input Leap (also known as input-leap ) versions through 3.0.3 is vulnerable to a directory traversal flaw on Windows and macOS platforms. When the non-default --enable-drag-drop option is active, the application mishandles the distinction between forward slashes (/) and backslashes (...

CVE-2026-100230

Input Leap aka input-leap through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message...

EUVD-2026-87130

Input Leap aka input-leap through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message...

CVE-2026-100230

Input Leap aka input-leap through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message...