CVE-2026-112605

This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files...

openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)

A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service DoS by convincing a user to run untrusted code within a sandboxed Java environment...

CVE-2026-112605

This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files...

EUVD-2026-113446

This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files...

CVE-2026-112605

A security vulnerability exists in Xcode versions prior to 27.2 due to improper handling of symlinks (symbolic links). This flaw allows an application to read arbitrary files on the system. The issue is resolved in Xcode 27.2 through improved symlink handling. No specific exploit information is p...

CVE-2026-106016

A flaw was found in Mozilla Firefox and Thunderbird. A mitigation bypass in the File Handling component allows an attacker to bypass security protections. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158. Mitigation Mitigation for this issue is either not available or the...

PT-2026-133700

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert palette images to truecolor function. This is due to insufficient file type validation before processing uploaded files. This...

PT-2026-133614

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require once. Attackers can supply path traversal sequences ../../ to include...

PT-2026-134197

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses...

CVE-2026-97209: elixir-lang elixir: Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another…

Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under th...

CVE-2026-118561: Drupal Single Content Sync: External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

RockyLinux 9 : aspell (RLSA-2026:92458)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:92458 advisory. aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 Tenable has extracted the preceding description block directly from the...

PT-2026-133285

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

Avada | Website Builder For WordPress & WooCommerce < 7.16.4 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field

Description The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded...

PT-2026-133745

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited...

AlmaLinux 9 : aspell (ALSA-2026:92458)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:92458 advisory. aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 Tenable has extracted the preceding description block directly from the...

RHEL 8 : mrtg (RHSA-2026:91845)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:91845 advisory. The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provid...

RHEL 9 : mrtg (RHSA-2026:92071)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:92071 advisory. The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provid...

PT-2026-134481

Name of the Vulnerable Software and Affected Versions Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress versions prior to 1.2.0 Description Insufficient file path validation in the post delete assessment file by id function allows for arbitrary file deletion on the server...

PT-2026-133667

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository,...