PT-2026-81153

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An incomplete denylist in the unsafe git revision options guard fails to include the --contents and -S options. This allows an attacker to read arbitrary files by passing these options to the...

PT-2026-81154

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An arbitrary file read issue exists in the TagReference.create function. A positional reference parameter allows the bypass of the unsafe option guard, enabling attackers to provide a reference...

UBUNTU-CVE-2026-63312

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...

PT-2026-81178

Name of the Vulnerable Software and Affected Versions Mane theme for WordPress versions prior to 1.8 Description The Mane theme for WordPress contains a Local File Inclusion flaw. This allows unauthenticated attackers to include and execute arbitrary files on the server, which can lead to the...

Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Overview The Kaltura HTML5 Player V2 Library mwEmbed / html5lib contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases tha...

Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

Description The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across...

CVE-2026-62383

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels,...

Linux Distros Unpatched Vulnerability : CVE-2026-78678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits --contents and -S options, allowing attackers t...

Linux Distros Unpatched Vulnerability : CVE-2026-78679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional reference parameter bypasses the unsafe option...

UBUNTU-CVE-2026-62383

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels,...

VulnCheck KEV: CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

CVE-2026-78679

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file= to read arbitrary files, with contents returned in the annotated tag message...

Linux Distros Unpatched Vulnerability : CVE-2026-79655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By...

UBUNTU-CVE-2026-62384

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

CVE-2026-78284

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

CVE-2026-32559

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-32559

UltimateAI is a WordPress plugin affected by an arbitrary file upload vulnerability in versions ≤ 3.1.0 . A user with Subscriber privilege level can upload arbitrary files without user interaction, with a scope change that allows full compromise of confidentiality, integrity, and availability (CV...

CVE-2026-32559 WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-78284 WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

CVE-2026-78284

CVE-2026-78284 is an unauthenticated arbitrary file deletion vulnerability in the MasterStudy LMS WordPress plugin, affecting versions 3.7.42 and earlier . An attacker can delete files on the server without any authentication or user interaction. The CVSS 3.1 base score is 8.6 (HIGH) , driven by ...