CVE-2026-81891 elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...

CVE-2026-79743 MCPHub: Path Traversal via Malicious MCPB Manifest Name

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

CVE-2026-79743

MCPHub is a unified hub for managing and orchestrating MCP servers/APIs. Prior to version 0.12.13 , its MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field is directly concatenated into a file path without sanitization or path traversal character validatio...

CVE-2026-79743 MCPHub: Path Traversal via Malicious MCPB Manifest Name

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

WordPress Master Addons for Elementor plugin <= 3.1.9 - Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction vulnerability

Authenticated Editor+ Arbitrary File Upload via uploadtemplatekit AJAX ZIP Extraction vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Master Addons for Elementor versions = 3.1.9...

cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction

A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem,...

PT-2026-84022

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70 Description The checkExtractItems function in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Due to the absence of .phtml, .phar, .php5, a...

EUVD-2026-68639

Stored Cross-Site Scripting XSS in TaskRunHandler.post in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task//run, the handler renders task log content logtmp into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from th...

CVE-2026-51153

CVE-2026-51153 is a stored XSS in QD (versions 20220208 through 20250803) affecting the TaskRunHandler.post() handler in web/handlers/task.py. The root cause is that task log content (logtmp) is rendered into the HTML response using Python % string formatting without HTML encoding . A low-privile...

CVE-2026-51153

Stored Cross-Site Scripting XSS in TaskRunHandler.post in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task//run, the handler renders task log content logtmp into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from th...

CVE-2026-82656

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

CVE-2026-82655

Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relationtypelist parameter of listsshow.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in rolelist and inject SQL through...

CVE-2026-82656 Admidio before 5.0.12 Path Traversal via Photo ZIP Download

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

CVE-2026-82655 Admidio before 5.0.12 SQL Injection via relation_type_list

Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relationtypelist parameter of listsshow.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in rolelist and inject SQL through...

EUVD-2026-68241

Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relationtypelist parameter of listsshow.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in rolelist and inject SQL through...

YellowKey-Bitlocker-CVE-2026-45585

🛡️ YellowKey-Bitlocker-CVE-2026-45585 - Recover Your BitLocker Keys Safely 📋 What This Software Does YellowKey is a free open-source utility for Windows 10 and Windows 11. It helps you extract, backup, and view your BitLocker recovery keys. This is useful if you lost access to your encrypted drive...

Linux Distros Unpatched Vulnerability : CVE-2026-82455

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination...

CVE-2026-82461

pac4j-oidc versions before 6.5.6 fail to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles via the KeycloakRolesAuthorizationGenerator component. Attackers with low privileges can forge access tokens containing administrative roles paire...

AZL-98403 CVE-2026-82455 affecting package ruby 3.3.5-8

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

CVE-2026-82455

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...