CVE-2026-118178 RSS feed could redirect its subscription to a local file or network share

A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make...

CVE-2026-118177

When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could mak...

CVE-2026-118178

The Thunderbird mail client is vulnerable to a flaw where a remote RSS feed can use the itunes:new-feed-url or newLocation element to change its stored subscription URL to a file: URL. This allows a malicious feed or an attacker capable of modifying an HTTP-delivered feed to force Thunderbird to ...

EUVD-2026-111354

When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could mak...

CVE-2026-118178 RSS feed could redirect its subscription to a local file or network share

A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make...

CVE-2026-118178

A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make...

CVE-2026-57202

The Asterisk telephony toolkit is vulnerable to a security bypass where an authenticated attacker with read-only ARI credentials can execute write dialplan functions. By using setChannelVar, an attacker can trigger functions like FILE() writes, even if live_dangerously is set to no in asterisk.co...

CVE-2026-57202 Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface ARI attacker with read-only privileges may use setChannelVar to execute write...

EUVD-2026-111345

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface ARI attacker with read-only privileges may use setChannelVar to execute write...

CVE-2026-57202 Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface ARI attacker with read-only privileges may use setChannelVar to execute write...

CVE-2026-57202 Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface ARI attacker with read-only privileges may use setChannelVar to execute write...

CVE-2026-57202

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface ARI attacker with read-only privileges may use "setChannelVar" to execute write...

WordPress Pie Register Premium plugin <= 3.8.4.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Chu Thao Mai in WordPress Plugin Pie Register Premium versions = 3.8.4.0...

CVE-2026-76913

An authenticated user with the HR "Manage Employees" permission "SAEMPLOYEE" can upload a file with an arbitrary extension through the employee Documents tab. The handler writes the raw client-supplied filename — extension intact — into a web-served directory with no extension, MIME, or content...

CVE-2026-116682 FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

CVE-2026-116682 FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

CVE-2026-116682

FileBrowser Quantum , a web-based file manager, is vulnerable to an arbitrary file read vulnerability in versions prior to 1.5.2-stable and 2.0.1-beta . The root cause is located in backend/pkg/indexing/indexingFiles.go, where the application resolves symbolic links using GetRealPath without veri...

CVE-2026-116682 FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

WordPress YOOtheme Pro theme 5.0.0-5.0.52 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by ? in WordPress Theme yootheme versions 5.0.0-5.0.52...

WordPress Tainacan plugin <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Editor+ Path Traversal to Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin Tainacan versions = 1.3.0...