Linux Distros Unpatched Vulnerability : CVE-2026-119720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in readfiledna that reads a GLOB block field without validating its...

WordPress Checkout Files Upload for WooCommerce 2.3.0 Shell Upload

WordPress Checkout Files Upload for WooCommerce versions before 2.4.0 contain an unauthenticated arbitrary file upload vulnerability that can lead to remote code execution when PHP is executable from the uploads directory. https://packetstorm.news/download/238668...

CVE-2026-118235: wpazleen: The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is…

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handleupload function. This is due to missing server-side file key allowlist and pre-sanitization...

CVE-2026-118599: GNOME Epiphany: A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompressxpithread used libarchive with archivereadsupportformatall and filters, so the installer did not require a real ZIP. A TAR file name...

CVE-2026-110251: villatheme Revopic – Photo Reviews for WooCommerce: The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all…

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. This is due to the deletereviewsimage function's deletecomment hook trusting attachment IDs supplied via the wcprimageuploadid POST...

CVE-2026-103882: acadlix: The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to…

The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postdeleteassessmentfilebyid function in all versions up to, and including, 1.1.9. This makes it possible for...

CVE-2026-120208: strukturag libheif: libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in…

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in uncdecodermixedinterleave::processTile that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-b...

CVE-2026-110176: Drupal File Force Download: The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a…

The File Force Download module for Drupal 7 implements hookfiledownload to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2...

PT-2026-134529

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence...

PT-2026-134504

Name of the Vulnerable Software and Affected Versions Epiphany versions 47.0 and later Description A file overwrite issue occurs during the installation of WebExtension packages from .xpi files. In the decompress xpi thread function within src/webextension/ephy-web-extension-manager.c, the use of...

GNOME Epiphany backlink vulnerability

GNOME Epiphany versions 47.0 and later contain a post-link vulnerability. This vulnerability arises because the xpi file is not restricted in its archive format during installation of WebExtension packages; this allows extraction of TAR hardlink entries. As a result, files created by existing use...

PT-2026-134434

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the ' construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers t...

Fedora 45 : unshield (2026-d79a7cf59b)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d79a7cf59b advisory. Validate the file table against the header size Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-61725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker- supplied 7z archive can write or overwrite files outside...

Rocky Linux 8 [CIQ] Security Update: aspell / aspell-debuginfo / aspell-debugsource / aspell-devel (crlsa-2026_92615)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202692615 advisory. aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 Tenable has extracted the preceding description block directly from the CIQ...

CVE-2026-120210: FFmpeg: FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files…

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence...

OpenSTAManager 2.10 Shell Upload

OpenSTAManager versions 2.10 and earlier contain an arbitrary file upload vulnerability in the module update functionality. The included proof of concept authenticates, creates a malicious module containing a PHP shell, and uploads it. https://packetstorm.news/download/238693...

Rocky Linux 9 [CIQ] Security Update: aspell / aspell-debuginfo / aspell-debugsource / aspell-devel (crlsa-2026_92458)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202692458 advisory. aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 Tenable has extracted the preceding description block directly from the CIQ...

Drupal File Force Download authorization issue vulnerability

Drupal File Force Download versions 7.1.0 through 7.1.2 contain an authorization issue vulnerability. This vulnerability arises because under private schemes, other modules are delegated to perform file access checks; however, under other schemes, responses are returned without any access...

CVE-2026-92294: brainstormforce Spectra Legacy – Gutenberg Blocks: The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file…

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the 'construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to...