WordPress The Innovative Form Builder – IvyForms plugin <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload vulnerability

Authenticated Custom+ Arbitrary File Upload vulnerability discovered by Wordfence PRISM in WordPress Plugin IvyForms versions = 1.5.1...

CVE-2026-118485

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding httpdecode on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f URL-encoded ../ sequences in the URL path. These sequences survive the URL...

EUVD-2026-112024

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding httpdecode on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f URL-encoded ../ sequences in the URL path. These sequences survive the URL...

mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link symlink following vulnerability. By influencing or pre-placing a symlink in the process ID PID file path, the attacker can trick...

Important: Red Hat Security Advisory: mrtg security update

An update for mrtg is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

CVE-2026-112198

XML External Entity XXE injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide ...

WordPress Checkout Files Upload for WooCommerce plugin < 2.4.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Josef Azizov Spoofable in WordPress Plugin Checkout Files Upload for WooCommerce versions 2.4.0...

WordPress Contact Manager plugin <= 9.1.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by sermsak in WordPress Plugin Contact Manager versions = 9.1.2...

CVE-2026-112198

The NoviGest Desktop App by Tactis contains an XML External Entity (XXE) injection vulnerability within its SAFT import feature . The root cause is that the application utilizes a JAXB Unmarshaller to process user-controlled XML files without properly disabling external entity resolution. An atta...

EUVD-2026-111993

XML External Entity XXE injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide ...

CVE-2022-31246

paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request e.g., within QR code data. On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial of service by specifying the /dev/zero filename...

CVE-2026-105457

A Path Traversal vulnerability exists in HAVELSAN Inc. Liman MYS (versions before 2.3.5-1132 ), characterized by an improper limitation of a pathname to a restricted directory. This flaw allows an authenticated user to perform arbitrary local file reads . The vulnerability is associated with CWE-...

CVE-2026-105457 Authenticated Arbitrary Local File Read via Path Traversal in HAVELSAN's Liman MYS

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: before 2.3.5-1132...

Denial Of Service (Dos)

monai is vulnerable to denial-of-service. The vulnerability is due to pydicom's failure to validate Decimal String DS and Integer String IS values, which allows an unauthenticated remote attacker to upload a crafted DICOM file containing NaN or infinity values via the REST API...

FileBrowser: Symlink Following Escapes User Scope Allowing Arbitrary File Read Outside The Served Directory

Summary File read paths resolve symbolic links with "filepath.EvalSymlinks" and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope for example to...

SiYuan: MCP File Tool's Blocklist Is Incomplete Relative To The HTTP File API It Claims To Align With, Exposing Publish-

Summary "kernel/mcp/tools/file.go"'s "resolvePath" includes an explicit comment stating its sensitive-path blocklist is meant to align with the HTTP file API's established blacklist "refuseToAccess" in "kernel/api/file.go", following the remediation for GHSA-cvhv-7xhj-xjp8 "Unauthenticated...

CockpitCMS-Arbitrary-File-Upload--XSS---Assets

Cockpit CMS 2.7.0 File Upload - XSS Author: Sergio Description: File upload vulnerability in Cockpit CMS 2.7.0 allows a local attacker to upload a pdf file with hidden XSS. Attack Vectors: AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L POC: This is the software version. This is the content of the XSS inject...

CVE-2026-110185

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image any body field referenced by the ImageHelper node's mix tag' parameter...

CVE-2026-109218

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the addmessage function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation...

CVE-2026-109384

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the...