Exploit for Path Traversal in Gradio_Project Gradio

HDU IS — Work 1: Secure REST API with CI/CD and Real-CVE Remed...

deepsecrets

OWASP DeepSecrets — a better tool for secrets scanning What is it? Another token-wasting CLI proxy to an AI API? Absolutely not! In our LLM-hype era, DeepSecrets still runs entirely on your machine — giving you great results offline, securely, and for free. So why yet another tool? Most existing...

SUSE CVE-2026-55888

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles method takes...

UBUNTU-CVE-2026-116840

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in ggufinitfromreader that bypasses the CVE-2025-53630 size check when padding near-SIZEMAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and...

CLEANSTART-2026-GK32984 On Unix systems, opening a file in an os

CVE-2026-39822 affects multiple packages. On Unix systems, opening a file in an os. See references for individual vulnerability details...

EUVD-2026-110508

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in...

CVE-2026-116800

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in...

CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

PHP Session Serialization Desynchronization Remote Code Execution

PHP web applications that dynamically switch session serialization handlers between phpserialize and php may be susceptible to session desynchronization and injection attacks. An unauthenticated attacker can abuse the PHPSESSIONUPLOADPROGRESS mechanism to inject specially crafted session data tha...

PT-2026-126378

Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files...

PT-2026-126658

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal...

PT-2026-126684

Name of the Vulnerable Software and Affected Versions systeminformation versions prior to 5.33.14 Description The Linux implementation of the networkStatsiface function fails to properly validate the iface variable when performing an fs.existsSync check and constructing paths under /sys/class/net...

PT-2026-126645

A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...

PT-2026-126648

A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service...

PT-2026-126601

Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159...

PT-2026-127166

Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response...

PT-2026-127170

Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension...

Psono Server authorization issue vulnerability

Versions 1.0.0 through 7.2.3 of Psono Server contain an authorization issue vulnerability. This vulnerability arises from the failure to enforce validation of the direction of file transfer credentials during file repository operations. As a result, authenticated remote attackers with read-only...

VulnCheck KEV: CVE-2026-84999

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the pieregfileupload function. This is due to the plugin performing file type validation via wpcheckfiletype and wpcheckfiletypeandext but never checking...

VulnCheck KEV: CVE-2026-28039

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in TMS wpDataTables wpdatatables allows PHP Local File Inclusion.This issue affects wpDataTables: from n/a through 6.5.0.1...