CVE-2026-63190

FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn authentication checks, CSRF protection or adequate path validation. On PHP's built-in...

CVE-2026-63190

FearlessCMS is a flat-file "content" management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under "admin/" perform privileged operations without "isLoggedIn" authentication checks, CSRF protection or adequate "path" validation. On PHP's...

MLflow Vulnerable To Arbitrary File Read On Unauthenticated Servers Via Prompt Model Version Source

Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in...

WordPress diarise theme <= 1.5.9 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Felipe Andrian Peixoto in WordPress Theme Diarise versions = 1.5.9...

WordPress Cherry Plugin plugin < 1.2.7 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by ? in WordPress Plugin Cherry Plugin versions 1.2.7...

WordPress Aspose Importer & Exporter (Discontinued) plugin <= 2.0 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Rq07 in WordPress Plugin Aspose Importer & Exporter versions = 2.0...

WordPress Memphis Documents Library plugin <= 3.1.5 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Felipe Molina de la Torre in WordPress Plugin Memphis Document Library versions = 3.1.5...

SUSE CVE-2026-115424

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a...

CVE-2026-117617

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers...

CVE-2026-117615

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system...

DRUPAL-CONTRIB-2026-274

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the...

CVE-2026-103403

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of...

CVE-2026-117617

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers...

EUVD-2026-112182

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers...

CVE-2026-117617

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers...

CVE-2026-117617

Jenkins versions 2.587 and earlier (LTS 2.580.1 and earlier ) are vulnerable to a race condition during artifact extraction. The software checks for symbolic links in the file path only before creating parent directories, but not immediately before the write operation. This oversight allows attac...

CVE-2026-117617

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers...

CVE-2026-117615

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system...

CVE-2026-117615

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system...

CVE-2026-117615

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system...