492201 matches found
CVE-2026-112605: Apple Xcode: This issue was addressed with improved handling of symlinks
This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files...
CVE-2026-114444: Unknown: The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its…
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...
CVE-2026-115346: ThemeFusion Avada | Website Builder For WordPress & WooCommerce: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in…
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded files. This mak...
CVE-2026-116250: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with…
In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with checkaccesspermission and then opened it by name. Several places opened it with a plain open or handed the path to a utility that opened it later: the servers.json export and import and the import fi...
CVE-2026-114422: Unknown Enable Media Replace: The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored…
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...
CVE-2026-119117: AWS amazon-kinesis-producer: Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the…
Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versio...
CVE-2026-118990: Improper Link Resolution Before File Access
CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob has the sqlite3 shell write the dump to /tmp/cbdump and never removes it. The file takes the process umask, and a symlink planted at that...
CVE-2026-119298: schollz croc: croc is a tool that allows any two computers to simply and securely transfer files and folders
croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact even when SendingText is...
PT-2026-134489
Name of the Vulnerable Software and Affected Versions SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications versions prior to 3.10.3 Description An arbitrary file upload issue exists in the handle upload function. The flaw stems from a missing server-side file key...
CVE-2026-110970: Zakład Ubezpieczeń Społecznych Płatnik: Płatnik uses HTTP protocol to download updates, libraries and support files
Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 334 in version 10.02.002...
PT-2026-133674
croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact even when SendingText is...
PT-2026-134210
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with download dir. An absolute path discards that base directory. An attacker with a vali...
PT-2026-134216
In Trail of Bits fickling through 0.1.12, a pickle STACK GLOBAL operand carrying a dotted qualname for example "Values.read file" is resolved by pickle's find class through getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading...
CVE-2025-68391: ARKETEAM: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to...
PT-2026-133276
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete file...
Apache Ambari 3.0.0 (MpackManager) Path Traversal Arbitrary File Write
Summary The Apache Ambari project is aimed at making Hadoop management simpler by developing software for provisioning, managing, and monitoring Apache Hadoop clusters. Ambari provides an intuitive, easy-to-use Hadoop management web UI backed by its RESTful APIs. Description Apache Ambari is...
PT-2026-133598
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, POST /api/agent data store/upload in backend/app/data store/data store routes.py permits customer user callers to choose bucket name and object name without an allowlist, tenan...
PT-2026-134201
LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decode preR13 entities in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decode preR13 in src/decode r11.c computes size from the raw file-controlled...
PT-2026-134165
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich ml/main.py accepted an options object and passed its values into model construction in machine-learning/immich...