PT-2026-133731

Name of the Vulnerable Software and Affected Versions LM Studio versions prior to 0.4.22+1 Description A path traversal issue exists in the model downloader's resolveDownloadRequest function. This allows attackers to write files outside the designated models directory by using backslash-separated...

PT-2026-134481

Name of the Vulnerable Software and Affected Versions Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress versions prior to 1.2.0 Description Insufficient file path validation in the post delete assessment file by id function allows for arbitrary file deletion on the server...

CVE-2026-112605: Apple Xcode: This issue was addressed with improved handling of symlinks

This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files...

CVE-2025-68391: ARKETEAM: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to...

CVE-2026-115346: ThemeFusion Avada | Website Builder For WordPress & WooCommerce: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in…

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded files. This mak...

PT-2026-133690

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, wi...

PT-2026-134489

Name of the Vulnerable Software and Affected Versions SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications versions prior to 3.10.3 Description An arbitrary file upload issue exists in the handle upload function. The flaw stems from a missing server-side file key...

Apache Ambari 3.0.0 (MpackManager) Path Traversal Arbitrary File Write

Summary The Apache Ambari project is aimed at making Hadoop management simpler by developing software for provisioning, managing, and monitoring Apache Hadoop clusters. Ambari provides an intuitive, easy-to-use Hadoop management web UI backed by its RESTful APIs. Description Apache Ambari is...

CVE-2026-62965: sabnzbd: SABnzbd is an open source automated Usenet download tool

SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with downloaddir. An absolute path discards that base directory. An attacker with a valid...

PT-2026-134210

SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with download dir. An absolute path discards that base directory. An attacker with a vali...

PT-2026-133751

Subscriber Arbitrary File Deletion in SureDash = 1.12.3 versions...

Rocky Linux 9 [CIQ] Security Update: skopeo / skopeo-debuginfo / skopeo-debugsource / skopeo-tests Multiple Vulnerabilities (crlsa-2026_90462)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202690462 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

AdminNeo SQLite Database-List Drop Arbitrary File Deletion

AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted db values directly to...

CVE-2026-104739: rabilal JS Help Desk – AI-Powered Support & Ticketing System: The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion…

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, wi...

CVE-2026-61645

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the Upload API arises because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious...

gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()`

A flaw was found in GitPython. This vulnerability allows an attacker to read arbitrary files from the filesystem. By exploiting an incomplete denylist in the unsafegitarchiveoptions guard, an attacker can supply specific options, such as --add-file or --add-virtual-file, to the Repo.archive...

GitPython: GitPython: Arbitrary file read via argument injection in branch checkout

A flaw was found in GitPython. An argument injection vulnerability in the branch checkout mechanism allows a remote attacker to read arbitrary files from the host system. By enticing an application to clone and check out a repository with a specially crafted branch name, an attacker can cause...

CVE-2026-61645

The Docat documentation hosting tool contains an arbitrary file upload vulnerability in its Upload API. The root cause is a lack of validation for the uploaded file path or type . An attacker can exploit this to overwrite sensitive configuration files or deposit malicious files on the web server....

EUVD-2026-113395

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the Upload API arises because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious...

CVE-2026-61645

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the "Upload API" arises because the API does not validate the "uploaded file path or type". An attacker can overwrite sensitive configuration files or place...