CVE-2026-103413

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's kubernetes.yaml and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and...

EUVD-2026-95757

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's kubernetes.yaml and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and...

CVE-2026-103413

Apache Camel Karavan versions 4.0.0 through 4.22.0 are vulnerable to an improper input validation flaw during deployment. The software unmarshals a project's kubernetes.yaml and applies all contained resources to the cluster without restricting resource kinds, rejecting security-sensitive pod opt...

cve-2026-85706

cve-2026-85706 Unauthentifiziertes beliebiges lokales Dateilesen in GitLab CE/EE. Betrifft 18.7–19.1.7, 19.2.0–19.2.5, 19.3.0–19.3.1. Behoben in 19.1.8 / 19.2.6 / 19.3.2 2026-09-10. CVSS 10.0, Berichten zufolge in freier Wildbahn ausgenutzt. Ursprünglicher Bericht von s3ntago, und dieses Repo ist...

Arbitrary File Access

Docling is vulnerable to arbitrary file read and write. The vulnerability is due to the Tectonic engine compiling untrusted TikZ input without restricting file access, which allows an attacker to read accessible files and create or overwrite writable files, with potential command execution if she...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

CVE-2026-107726

A flaw was found in Hazelcast. Improper validation of client-supplied data allows a connected client to corrupt memory, potentially leading to arbitrary code execution on cluster members. Additionally, an attacker can exploit this vulnerability to read sensitive memory contents from cluster nodes...

CVE-2026-107725

A flaw was found in Hazelcast. Due to missing authorization checks within the IMap Predicates application programming interface API, an authenticated client with limited privileges can bypass access controls. This vulnerability allows an attacker to achieve arbitrary code execution on a cluster...

EUVD-2026-95709

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...

BIT-GHOST-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

CVE-2026-107935

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system...

CVE-2026-94503

The PX-lab Zombify WordPress plugin (versions n/a through 1.7.7 ) is vulnerable to an Unrestricted Upload of File with Dangerous Type (CWE-434). This vulnerability allows an attacker to upload a web shell to the web server, potentially leading to unauthorized access and control. No specific remed...

CVE-2026-94503 WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...

CVE-2026-94503 WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...

CVE-2026-94666

The ZealousWeb Generate PDF using Contact Form 7 WordPress plugin (versions n/a through 4.2.1 ) is vulnerable to a Path Traversal vulnerability. This flaw allows an attacker to perform an Arbitrary File Download , potentially exposing sensitive files on the server. No specific remediation steps o...

CVE-2026-94664 WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0...

CVE-2026-94666 WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1...

CVE-2026-94664

The PDF for Contact Form 7 WordPress plugin (versions 7.1.0 and below ) is vulnerable to a Path Traversal vulnerability (CWE-22). This flaw allows an attacker to perform an Arbitrary File Download , potentially exposing sensitive files on the server. Exploitation details regarding specific vector...

CVE-2026-98210

A flaw was found in the Linux kernel's mxcmmc host driver. A local user with administrative privileges could trigger this vulnerability by unbinding or removing the device, leading to a Denial of Service DoS or potential arbitrary code execution. The driver fails to cancel active background tasks...

CVE-2026-102422

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...