EUVD-2026-58088

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

CVE-2026-73509 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...

atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read

The optional dashboard HTTP server atomicagents/dashboard/serve.py builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through io.saferesolveunder. Literal ../ segmen...

CVE-2026-65582

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

CVE-2026-61980

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

CVE-2026-28189

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

EUVD-2026-57980

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

CVE-2026-65582

CVE-2026-65582 affects the WordPress AI Hub theme (versions <= 1.3.10). The available documents describe a Subscriber Arbitrary File Download vulnerability in AI Hub

CVE-2026-65582 WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

CVE-2026-65582

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

EUVD-2026-57977

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

CVE-2026-61980

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

CVE-2026-61980 WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

CVE-2026-61980

CVE-2026-61980 describes an Unauthenticated Arbitrary File Download in OMGF Pro plugin for WordPress, version

CVE-2026-28189

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

CVE-2026-28189

The CVE-2026-28189 entry concerns the WordPress Participants Database plugin version &lt;= 2.7.8.4, which is affected by an unauthenticated Arbitrary File Deletion vulnerability. The available records indicate the issue arises in this plugin series and can be triggered without authentication, wit...

CVE-2026-28189 WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

EUVD-2026-57967

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Piotnet Addons For Elementor Pro versions = 7.1.67...

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...