osTicket - Arbitrary File Read

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficientl...

CVE-2026-112605

This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files...

CVE-2026-112605

The software Xcode is vulnerable to an issue where an application may be able to read arbitrary files . This is caused by inadequate handling of symlinks . The vulnerability is addressed in Xcode 27.2 through improved symlink handling. No specific exploit details or in-the-wild exploitation infor...

EUVD-2026-113446

This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files...

CVE-2026-112605: Apple Xcode: This issue was addressed with improved handling of symlinks

This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files...

PT-2026-133731

Name of the Vulnerable Software and Affected Versions LM Studio versions prior to 0.4.22+1 Description A path traversal issue exists in the model downloader's resolveDownloadRequest function. This allows attackers to write files outside the designated models directory by using backslash-separated...

CVE-2026-115346: ThemeFusion Avada | Website Builder For WordPress & WooCommerce: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in…

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded files. This mak...

CVE-2026-62965: sabnzbd: SABnzbd is an open source automated Usenet download tool

SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with downloaddir. An absolute path discards that base directory. An attacker with a valid...

PT-2026-133440

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to...

CVE-2026-115604: Brainstorm Force SureDash: Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.

Subscriber Arbitrary File Deletion in SureDash = 1.12.3 versions...

CVE-2026-104739: rabilal JS Help Desk – AI-Powered Support & Ticketing System: The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion…

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, wi...

Rocky Linux 9 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2026_90424)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202690424 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc Multiple Vulnerabilities (crlsa-2026_90362)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202690362 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

Rocky Linux 9 [CIQ] Security Update: skopeo / skopeo-debuginfo / skopeo-debugsource / skopeo-tests Multiple Vulnerabilities (crlsa-2026_90462)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202690462 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

CVE-2026-61645

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the Upload API arises because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious...

GitPython: GitPython: Arbitrary file read via argument injection in branch checkout

A flaw was found in GitPython. An argument injection vulnerability in the branch checkout mechanism allows a remote attacker to read arbitrary files from the host system. By enticing an application to clone and check out a repository with a specially crafted branch name, an attacker can cause...

gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()`

A flaw was found in GitPython. This vulnerability allows an attacker to read arbitrary files from the filesystem. By exploiting an incomplete denylist in the unsafegitarchiveoptions guard, an attacker can supply specific options, such as --add-file or --add-virtual-file, to the Repo.archive...

CVE-2026-61645 Docat has Arbitrary File Upload exists in Upload API

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the Upload API arises because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious...

CVE-2026-61645 Docat has Arbitrary File Upload exists in Upload API

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the Upload API arises because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious...

CVE-2026-61645

The Docat documentation hosting tool contains an arbitrary file upload vulnerability in its Upload API. The root cause is a lack of validation for the uploaded file path or type . An attacker can exploit this to overwrite sensitive configuration files or deposit malicious files on the web server....