CVE-2026-107042

A flaw was found in USP Ultimate Screenshot Painter due to insecure permissions. An attacker can exploit this vulnerability by supplying a crafted content Uniform Resource Identifier URI. Successful exploitation allows the attacker to move or overwrite files stored in another user's private...

CVE-2019-11510-PulseVPN

CVE-2019-11510-PulseVPN In Pulse Secure Pulse Connect Secure PCS 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability. exploit.sh = Exploring Vulnerability...

CVE-2026-107049

An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string...

CVE-2026-107049: n/a: An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via…

An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string...

EUVD-2026-113264

An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string...

CVE-2026-107049

An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string...

CVE-2026-107049

An issue in Forkyz (versionCode 8500000) allows attackers to arbitrarily change another user's storage settings by supplying a crafted URI string . This vulnerability is associated with CWE-863 (Incorrect Authorization). No specific remediation steps or exploit details are provided in the documen...

CVE-2026-107049

An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string...

PT-2026-132381

An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string...

CVE-2026-51773

A flaw was found in the VMware datastore driver of OpenStack glancestore. When an authenticated user supplies a crafted image location Uniform Resource Identifier URI pointing to an external host, the driver fails to validate the destination before forwarding requests. An attacker can exploit thi...

DEBIAN-CVE-2026-51773

An issue in the VMware datastore driver of OpenStack glancestore. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the retryrequest function fails to validate the destination host before attaching sensitive authentication headers...

EUVD-2026-87084

An issue in the VMware datastore driver of OpenStack glancestore. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the retryrequest function fails to validate the destination host before attaching sensitive authentication headers...

Pulse Connect Secure SSL VPN Arbitrary File Read Detection

Pulse Secure Pulse Connect Secure PCS 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 all contain an arbitrary file reading vulnerability that could allow unauthenticated remote attackers to send a specially crafted URI to gain improper access. !/usr/bin/env python3 -- coding: utf...

CVE-2026-2604

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or...

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the PolicyReference API when fetching remote policy references. An attacker can access internal resources or arbitrary protocols by supplying a crafted URI. Remediation Upgrade org.apache.neethi:neet...

MiracleLinux 7 : httpd-2.4.6-97.1.0.1.el7.AXS7 (AXSA:2021-2480:01)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2480:01 advisory. httpd: modproxy: SSRF via a crafted request uri-path containing unix: CVE-2021-40438 Tenable has extracted the preceding description block directly from the...

GHSA-CPHF-4846-3XX9 Vert.x Web static handler component cache can be manipulated to deny the access to static files

The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component used b...

CVE-2026-1002 Eclipse Vert.x Web static handler file access denial

The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component used b...

CVE-2026-1002 Eclipse Vert.x Web static handler file access denial

The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component used b...