CVE-2026-78470

WP Project Manager Pro is a WordPress plugin vulnerable to SQL Injection in all versions up to and including 4.0.1 . The root cause is insufficient escaping on a user-supplied parameter combined with a lack of prepared statements in the existing SQL query. An authenticated attacker with Subscribe...

EUVD-2026-65299

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

CVE-2026-78638 peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The...

EUVD-2026-65301

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The...

CVE-2026-78638

peerigon unzip-crx and unzip-crx-3 (up to 0.2.0 ) contain a path traversal vulnerability in the unzip function of dist/index.js (Archive Extraction component). Manipulating the destination argument allows writing files outside the intended directory. The attack requires local access with low priv...

CVE-2026-76839 Grav before 2.0.16 Information Disclosure via offsetGet

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

PT-2026-81176

Name of the Vulnerable Software and Affected Versions WP Project Manager Pro versions prior to 4.0.2 Description Insufficient escaping of user-supplied parameters and lack of proper preparation in SQL queries allow authenticated attackers with Subscriber-level access and above to perform SQL...

PT-2026-81903

LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip extractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end of the decompressed stream, so only the size of the uploade...

Linux Distros Unpatched Vulnerability : CVE-2026-78322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's...

Linux Distros Unpatched Vulnerability : CVE-2026-79655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By...

PT-2026-81195

Name of the Vulnerable Software and Affected Versions file-roller affected versions not specified Description A flaw exists when opening or extracting malicious 7z or RAR archives containing a file entry with an excessively long path. The progress-line parsing mechanism copies the path into a...

EUVD-2026-65083

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search...

CVE-2026-71510 Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search...

awx: project archive extraction allows path traversal file writes

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

awx: project archive extraction allows path traversal file writes

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2026-77679

A path traversal ZIP slip vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, the decompressxpithread function extracts XPI archives ZIP format to disk using libarchive. For each archive entry, the output path i...

CVE-2026-71364

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...

CVE-2026-71364

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2026-71364

A path traversal vulnerability in AWX 's project_archive action plugin (part of Red Hat Ansible Automation Platform ) allows arbitrary file writes on the execution node. The plugin extracts zip/tar members by joining the project directory path with the member filename without path normalization o...