CVE-2024-29404_Razer

CVE-2024-29404 Razer Synapse 3 =Synapse versione 3.9.131.20813 App versione =20240213 Vulnerabilità di elevazione dei privilegi nella funzionalità "Chroma Effects" tramite rimozione arbitraria di file/cartelle https://github.com/user-attachments/assets/6528f166-5514-4b10-b1a4-3644ec11e772...

CVE-2026-81743

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-40526 Volmarg Personal Management System Path Traversal via get-file Endpoint

Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...

WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Read vulnerability

Subscriber+ Arbitrary File Read vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...

WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Upload vulnerability

Subscriber+ Arbitrary File Upload vulnerability discovered by Erwan LR WPScan in WordPress Plugin Workeera versions 1.0.6...

CVE-2026-71492

A flaw was found in Banks. The DirectoryPromptRegistry.set function improperly handles attacker-controlled Prompt.name and Prompt.version values. This allows for path traversal, enabling an attacker to write arbitrary files outside the intended registry root. This vulnerability could lead to...

EUVD-2026-67007

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-46345

A flaw was found in compliance-trestle. The trestle author jinja command, when processing the -o/--output argument, is vulnerable to path traversal. This allows a local attacker to write files to arbitrary locations outside the intended workspace by providing specially crafted path sequences or...

CVE-2026-19693

A flaw was found in extract-zip. This vulnerability allows a remote attacker to perform an arbitrary file write outside the intended destination directory. By crafting a malicious zip archive containing a symbolic link symlink and a regular file with the same name, the attacker can bypass securit...

By-Poloss..-..CVE-2026-18080

CVE-2026-18080 — ERP Complete HR, Accounting & CRM Suite = 1.17.7 Upload Arbitrário de Arquivo Não Autenticado via Anexo de E-mail do CRM Email Connect Path Traversal → RCE...

CVE-2026-81572

In CodeMeter Runtime from version 8.40 to excluding 8.41a and 9.00 to excluding 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before fi...

CVE-2026-78274

Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-81659

Flowintel is vulnerable to arbitrary local file read via its note PDF export feature. Attacker-controlled note content is processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export. The CVSS 4...

CVE-2026-81659 Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing

Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export...

CVE-2026-26336-PoC

CVE-2026-26336 — Alfresco Share Unauthentifiziertes Dateilesen Überblick Alfresco Share stellt einen /share/page/resource/-Endpunkt bereit, der zum Ausliefern statischer Ressourcen verwendet wird. In verwundbaren Versionen schränkt dieser Endpunkt Pfad-Traversal nicht ordnungsgemäß ein, sodass ei...

CVE-2026-58073-check

Script di rilevamento dello stato di patch per l'impersonificazione dell'agente di Veeam Service Provider Console Un rilevatore sicuro e non autenticato per le vulnerabilità KB4893 in Veeam Service Provider Console pubblicato il 04-08-2026. Risponde a una domanda per ogni target, prima di qualsia...

CVE-2026-21627---Tassos-Novarain-Framework-plg_system_nrframework-Exploit---Joomla

CVE-2026-21627 Nicht authentifizierte beliebige Dateieinbindung im Novarain Framework von Joomla nrframework Überblick Eine kritische Schwachstelle im Tassos/Novarain Framework plgsystemnrframework Joomla-Plugin ermöglicht es nicht authentifizierten Angreifern, beliebige PHP-Dateien auf dem Serve...

CVE-2026-0740

CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 Caricamento Arbitrario di File Non Autenticato. Descrizione : Il plugin Ninja Forms - File Uploads per WordPress è vulnerabile al caricamento arbitrario di file non autenticato a causa della mancanza di validazione del tipo di file e della mancan...

CVE-2026-4350

CVE-2026-4350 - Perfmatters WordPress Eliminazione Arbitraria di File Descrizione CVE-2026-4350 è una vulnerabilità di eliminazione arbitraria di file nel plugin WordPress Perfmatters. Dettagli CVE CVE: CVE-2026-4350 Gravità: ALTA CVSS: 8.1 Plugin interessato: Perfmatters Versione interessata: =...

CVE-2026-30345

CVE-2026-30345 Proof of Concept Beliebige Datei-Schreib-Schwachstelle in der Backup-Import-Funktion von CTFd 3.8.2. Schnellstart Vor dem Ausführen von cve202630345bashrcpoc.py Stellen Sie sicher, dass Sie die Werte entsprechend für Ihren Exploit aktualisieren. Werte wie RHOST, ATTACKER-IP oder PO...