CVE-2026-94503 WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...

CVE-2026-94666 WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1...

CVE-2026-94664

The PDF for Contact Form 7 WordPress plugin (versions 7.1.0 and below ) is vulnerable to a Path Traversal vulnerability (CWE-22). This flaw allows an attacker to perform an Arbitrary File Download , potentially exposing sensitive files on the server. Exploitation details regarding specific vector...

CVE-2026-94666

The ZealousWeb Generate PDF using Contact Form 7 WordPress plugin (versions n/a through 4.2.1 ) is vulnerable to a Path Traversal vulnerability. This flaw allows an attacker to perform an Arbitrary File Download , potentially exposing sensitive files on the server. No specific remediation steps o...

CVE-2026-94664 WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0...

CVE-2026-98210

A flaw was found in the Linux kernel's mxcmmc host driver. A local user with administrative privileges could trigger this vulnerability by unbinding or removing the device, leading to a Denial of Service DoS or potential arbitrary code execution. The driver fails to cancel active background tasks...

CVE-2026-102422

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...

CVE-2026-56154

A use-after-free flaw was found in the modrewrite module of Apache HTTP Server when evaluating URL lookahead expressions that reference HTTP request headers, such as %LA-U:HTTP:.... A remote attacker may be able to trigger invalid memory access in a server using an affected rewrite configuration,...

EUVD-2026-95578

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system...

CVE-2026-107935

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system...

CVE-2026-107935

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

CVE-2026-19585

A flaw was found in go-getter. A remote attacker can exploit a path traversal vulnerability to write files outside of the intended target directory during directory downloads from Amazon Simple Storage Service S3 or Google Cloud Storage GCS. By supplying specially crafted file paths within a remo...

CVE-2025-14123

The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

EUVD-2025-211057

The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it...

CVE-2026-93548

The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in tha...

CVE-2025-15700

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly...

dlink

Iniezione di comandi e account backdoor nei dispositivi NAS D-Link Riepilogo della vulnerabilità: La vulnerabilità descritta interessa diversi dispositivi NAS D-Link, inclusi i modelli DNS-340L, DNS-320L, DNS-327L e DNS-325, tra gli altri. La vulnerabilità risiede nell'URI nassharing.cgi , che è...

Improper Input Validation

Hazelcast is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of data supplied by a malicious client connected to the cluster, which allows an attacker to read arbitrary memory from a cluster member, crash the member, or potentially corrupt memory and execu...