CVE-2026-62052: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Tipsy = 1.6 versions...

CVE-2026-62025: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in Tailored Tools = 3.0.3 versions...

CVE-2026-62024: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in CodeBard Help Desk = 1.1.2 versions...

CVE-2026-40805: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Deletion in PeepSo = 9.0.5.4 versions...

CVE-2026-102291: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's displayname into the composed page markup unfiltered and then running the...

CVE-2026-89100: Improper Neutralization of Input During Web Page Generation

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-104801: Improper Limitation of a Pathname to a Restricted Directory

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the renamefiles function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete...

CVE-2026-83526: Unrestricted Upload of File with Dangerous Type

The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the checkmimetype function. This is due to insufficient file type validation in checkmimetype, which writes attacker-supplied remote file content to the public uploads...

CVE-2026-105989: Missing Authorization

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments...

PT-2026-109616

Name of the Vulnerable Software and Affected Versions Divi Plus versions prior to 2.4.1 Description The Divi Plus plugin for WordPress allows unauthenticated attackers to read arbitrary files on the server. This occurs because the permission callback function SVGAnimatorController::index permissi...

Linux Distros Unpatched Vulnerability : CVE-2026-107935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap- vsock package. The unauthenticated...

PT-2026-109477

Name of the Vulnerable Software and Affected Versions Extensions For CF7 versions prior to 3.4.6 Description An arbitrary file upload flaw exists in the extcf7 submit function. The issue stems from missing file extension, MIME type, and size validation within the validation filter of the signatur...

CVE-2026-104899: Improper Control of Filename for Include/Require Statement in PHP Program

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'designtype' parameter parameter. This makes it possible for unauthenticated attackers to include and...

PT-2026-109518

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions prior to 2.10.6 Description The plugin fails to confine media-import file copies to the document root and does not enforce effective file-type restrictions. This allows users with the Author role or higher to plant...

PT-2026-109858

Subscriber Arbitrary File Deletion in FoodBakery = 4.6 versions...

PT-2026-109760

Name of the Vulnerable Software and Affected Versions PeepSo versions prior to 9.0.5.5 Description A flaw allows a user with Subscriber privileges to perform arbitrary file deletion on the system. Recommendations Update to version 9.0.5.5 or later...

PT-2026-109748

Name of the Vulnerable Software and Affected Versions slide-maker versions prior to 5.8.1 Description A path traversal issue exists in the generate images openai.py file. This flaw allows attackers to write image files outside the intended output directory by manipulating filenames provided in th...

PT-2026-109738

Name of the Vulnerable Software and Affected Versions Cohere Python SDK versions 5.11.0 through 7.2.0 Description A path traversal tar slip issue exists in the s3 models dir to tarfile function. This occurs due to unvalidated tarfile.extractall calls, which allow arbitrary file writes. An attacke...

cve-2020-10977

CVE-2020-10977 GitLab 12.9.0 Lectura Arbitraria de Archivos Objetivo : 12.9.0 e inferiores Probado : GitLab 12.8.1 En una reciente evaluación encontré una instancia de GitLab en el objetivo, encontré un PoC en Exploit-DB pero usa LDAP para autenticación y en este caso estaba deshabilitado, así qu...

spring-break_cve-2017-8046

spring-breakcve-2017-8046 Este es un programa Java que explota la vulnerabilidad Spring Break CVE-2017-8046. Este software está escrito para tener la menor cantidad de dependencias externas posible. AVISO LEGAL Esta herramienta está destinada a ingenieros de seguridad y profesionales de appsec pa...