CVE-2026-48055: Improper Input Validation

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction,...

CVE-2026-12567: Improper Link Resolution Before File Access

The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...

CVE-2026-12568: Improper Limitation of a Pathname to a Restricted Directory

The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...

CVE-2025-69131: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site = 1.0.7 versions...

CVE-2026-40747: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Ecommerce Zone = 0.9.7 versions...

CVE-2026-54193: Improper Limitation of a Pathname to a Restricted Directory

Contributor Arbitrary File Deletion in Fusion Builder = 3.15.4 versions...

CVE-2026-47277: Improper Limitation of a Pathname to a Restricted Directory

Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store repositories through an unauthenticated endpoint, which leads to arbitrary file read through app-store logo symlinks. The path guard checks only...

CVE-2026-52716: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Deletion in WorkScout-Core = 1.7.11 versions...

CVE-2026-52705: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms = 1.4.5 versions...

CVE-2026-39589: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Webenvo = 0.0.6 versions...

CVE-2026-40724: Improper Limitation of a Pathname to a Restricted Directory

CP Client Arbitrary File Download in Client Portal Pro = 5.6.2 versions...

PT-2026-50318

Subscriber Arbitrary File Upload in Ecommerce Zone = 0.9.7 versions...

PT-2026-50298

Unauthenticated Arbitrary File Deletion in BookPro = 1.1.0 versions...

PT-2026-50281

Subscriber Arbitrary File Upload in Restaurt = 1.0.4 versions...

PT-2026-50320

Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...

CVE-2026-12565: Improper Limitation of a Pathname to a Restricted Directory

The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools e.g. GNU tar which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extractio...

CVE-2026-9690: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Download in WP Media folder Addon = 4.0.1 versions...

PT-2026-50319

Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...

PT-2026-50363

Name of the Vulnerable Software and Affected Versions WP Media folder Addon versions 4.0.1 and earlier Description An unauthenticated arbitrary file download issue exists, allowing an attacker to download files from the server without providing credentials. Recommendations Update WP Media folder...

📄 Discuz! X5.0 Chained Remote Code Execution

This Metasploit module uses race condition and local file inclusion vulnerabilities in Discuz! X5.0 in order to achieve remote code execution. ================================================================================================================================== | Title : Discuz! X5.0...