GHSA-CJ62-HVV2-2Q5H Ghost: Database Backup Path Traversal

Impact An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues. Vulnerable versions This vulnerability is present in Ghost from 1.20.1 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For...

Directory Traversal

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Directory Traversal in the database backup and export filename handling through the backup/export filename processing in the admin backend and exporter modules. An administrator-level attacker can overwrit...

NPM: Ghost: Database Backup Path Traversal

NPM: Ghost: Database Backup Path Traversal vulnerability discovered by ? in WordPress Npm ghost versions = 1.20.1, 6.54.1...

Ghost: Database Backup Path Traversal

Impact An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues. Vulnerable versions This vulnerability is present in Ghost from 1.20.1 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For...

CVE-2026-70592

Ghost is a Node.js content management system. In versions 1.20.1 through 6.54.1, an Administrator-level user could remotely overwrite certain filesystem files via the database backup filename because the database export endpoint did not reject path separators in the caller-supplied filename. This...

CVE-2026-70592

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

CVE-2026-70592 Ghost: Database Backup Path Traversal

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

CVE-2026-70592 Ghost: Database Backup Path Traversal

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

CVE-2026-70592 Ghost: Database Backup Path Traversal

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

WordPress Backup Migration plugin <= 2.1.1 - Authenticated (Administrator+) OS Command Injection vulnerability

Authenticated Administrator+ OS Command Injection vulnerability discovered by at1as in WordPress Plugin Backup Migration versions = 2.1.1...

Le Panthéon de la Souveraineté — Updated!

🏠 Developed on: GitLab | 🪞 Automated mirror on: GitHub 🏛️ The Pantheon of Sovereignty A 100% sovereign, redundant and secure cloud infrastructure, designed to completely break free from GAFAM. Version 1.1: Private network foundation, DNS request encryption for servers DoT and multi-datacenter...

CVE-2026-18759

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

CVE-2026-18759 An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

CVE-2026-18759

CVE-2026-18759 affects ASUSTOR Backup Plan (ABP) and ASUSTOR EZ Sync (AES): a file-based IPC protected by AES can be abused by a local authenticated user to recover the IPC key (readable by standard users, DPAPI-protected) and forge IPC requests. Combined with an insufficient substring check for ...

CVE-2026-18759 An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

CVE-2026-18759

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

[SECURITY] Fedora 43 Update: borgbackup-1.4.5-1.fc43

BorgBackup short: Borg is a deduplicating backup program. Optionally, it supports compression and authenticated encryption...

CVE-2026-18759: Improper Authentication

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

PT-2026-78385

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description An authentication bypass exists in the SetupController when maintenance mode is enabled. This allows unauthenticated remote attackers to execute database migrations and create configuration backups...

VulnCheck KEV: CVE-2026-28409

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution RCE vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access which can be obtained via the previously reported...