EUVD-2026-81693

pgAdmin 4's File Manager savefile endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.checkaccesspermission and then opened the file for writing with a plain open call. CVE-2026-7819 had previously hardened the separate file upload path by openi...

CVE-2026-92970

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen pat...

CVE-2026-92970 HUBzero CMS through 2.2.32 Path Traversal via File Upload

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen pat...

CVE-2026-92919 admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

CVE-2026-92919 admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

EUVD-2026-81574

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

CVE-2026-92919

admin3 versions through 3.0.0 are affected by an arbitrary file write vulnerability in the storage upload handler . The application fails to sanitize client-supplied filenames, allowing authenticated (low-privilege) users to inject dot-dot path traversal segments that escape the configured storag...

CVE-2026-88795

The wpShopGermany IT-RECHT KANZLEI WordPress plugin (versions before 2.4 ) contains a vulnerability where it fails to generate API authentication tokens securely. The plugin derives these tokens from data controlled by the requester and creates them as a side effect of the validation check. This ...

CVE-2026-88795 wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...

CVE-2026-88795 wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...

PT-2026-94388

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.18 Description The save file endpoint in the File Manager, used by the Query Tool and ERD, contains a race condition. While the system validates the requested path using the check access permission function, it...

CVE-2026-92919: Improper Limitation of a Pathname to a Restricted Directory

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

CVE-2026-86861: Time-of-check Time-of-use (TOCTOU) Race Condition

pgAdmin 4's File Manager savefile endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.checkaccesspermission and then opened the file for writing with a plain open call. CVE-2026-7819 had previously hardened the separate file upload path by openi...

CVE-2026-54583: Improper Limitation of a Pathname to a Restricted Directory

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry-bundlefile, an...

CVE-2026-54053: Improper Limitation of a Pathname to a Restricted Directory

Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside...

CVE-2026-15815: Improper Link Resolution Before File Access

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory...

CVE-2026-92970: Improper Limitation of a Pathname to a Restricted Directory

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen pat...

CVE-2026-89038: Improper Limitation of a Pathname to a Restricted Directory

Verizon Cloud for Android com.vcast.mediamanager before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted displayname value containing path-traversal...

CVE-2026-88795: Improper Control of Generation of Code

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...

CVE-2026-92748

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicio...