CVE-2026-19635

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction...

CVE-2026-19635

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction...

CVE-2026-19635

CVE-2026-19635 is a local privilege escalation in Security Center. The advisory states: an attacker with write access to a specific configuration file can achieve arbitrary code execution with elevated privileges, without user interaction. The entry is listed in the Tenable advisory for Security ...

EUVD-2026-58734

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction...

CVE-2026-19635 Local Privilege Escalation

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction...

CVE-2026-19768

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

PT-2026-72059

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction...

Zyxel USG FLEX 50(W) / USG20(W)-VPN 4.16 < 5.43 / ATP 4.32 < 5.43 / USG FLEX 4.50 < 5.43 Path Traversal

The firmware version of the Zyxel ZLD firewall device is affected by a path traversal vulnerability. A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via improper handling of symlinks in input configuration file processing, including --files-from, --password-file, and filter merge files. An attacker can access files outside the intended directory ...

CVE-2026-53802 rsync < 3.5.0 Arbitrary File Read via Symlink Following

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

PT-2026-71640

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description An arbitrary file read issue exists due to improper symlink following during the handling of input configuration files. Attackers can read files accessible to the rsync daemon process by placing a...

CVE-2026-13094 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file...

CVE-2026-13094

IBM i Access Client Solutions (ACS) is affected by CVE-2026-13094. Vulnerable versions are ACS 1.1.2.0 through 1.1.9.13 on Windows when installed for all users, due to a publicly writable configuration file that enables arbitrary code execution. The IBM advisory lists a base CVSS v3.1 score of 7....

PT-2026-71321

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file...

PT-2026-70054

Name of the Vulnerable Software and Affected Versions wildfly-core affected versions not specified Description An authenticated administrative user can inject a malformed payload into the Inet Address field via the Management Model. This action causes the server to crash and enter an unrecoverabl...

PT-2026-70070

Name of the Vulnerable Software and Affected Versions Axis Communications ACAP affected versions not specified Description An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This issue is exploitable only if the device is configured to allow t...

CVE-2026-70619 Odysseus Missing Admin Authorization via Embedding Endpoint Routes

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...

CVE-2026-70553

MaxSite CMS is affected by an unauthenticated remote code execution vulnerability. An attacker can submit crafted POST data to the install endpoint after installation, using a malicious db_dbprefix value to break out of a PHP string in application/config/database.php and inject PHP statements tha...

CVE-2026-17614

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...

CVE-2026-14818

CVE-2026-14818 describes a path traversal vulnerability in the CLI command used to execute configuration files on Zyxel devices. Affected firmware ranges include Zyxel ATP series (V4.32–V5.42 Patch 1), USG FLEX series (V4.50–V5.42 Patch 1), USG FLEX 50(W) series (V4.16–V5.42 Patch 1), and USG20(W...