CVE-2026-115350

A flaw was found in mistune. An attacker can exploit this vulnerability to conduct stored Cross-Site Scripting XSS attacks through the file inclusion directive. By referencing a crafted HTML file, unescaped content is processed as raw markup, enabling the execution of arbitrary script code in the...

Part-DB arbitrary file upload vulnerability

Versions prior to Part-DB 2.12.1 contain an arbitrary file upload vulnerability. This vulnerability arises because the attachment upload handler stores uploaded files using client-supplied file extensions; however, the extension blacklist does not include “phar”. As a result, uploaded .phar files...

UBUNTU-CVE-2026-114714

Fix unsafe use of a login name in SquirrelMail import file path...

Fortinet FortiSIEM 7.5.0 Path Traversal

Fortinet FortiSIEM version 7.5.0 contains a path traversal flaw in phQueryMaster that allows unauthenticated arbitrary file writes and execution of unauthorized code or commands via specially crafted packets. https://packetstorm.news/download/237290...

PT-2026-122223

A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load model of the file pymllm/mobile/convertor/ init .py of the component Convertor. The manipulation of the argument shard file leads to path traversal. The attack needs to be performed...

PT-2026-122435

Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outsid...

PT-2026-122235

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hidden dim/class num results in out-of-bounds read...

PT-2026-122204

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.21.2 Description An attacker can craft a PDF file that repeatedly references the same nonexistent indirect object. When accessed, this causes relevant file parts, such as pages, to trigger repeated full-file recovery...

PT-2026-121753

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces...

CVE-2025-30052: Authentication Bypass by Spoofing

The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. The...

PT-2026-121750

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with...

PT-2026-135097

Security vulnerability affects the rundeck package. The ftp and scp tasks of Apache Ant can download files from a remote server...

Apple container security vulnerability

Versions of the Apple container prior to 1.5.0 contain a security vulnerability. This vulnerability allows attackers to write to the container’s file system and insert an exec credential plugin into /etc/kubernetes/admin.conf. When kubectl runs on the host, it executes this plugin as a macOS user...

Kakao buffer overflow vulnerability

Versions 0.1, 0.2, 0.3, and 0.4 of KAKAO contain a buffer error vulnerability. This vulnerability stems from improper handling of the hiddendim and classnum parameters in the khaiii::nn::Linear::open function within the JSON Config File Handler component, potentially leading to out-of-bounds read...

ROS-20261023-73-0125

The vulnerability of the Boxstts::getsampleduration function in the HEIF and AVIF file encoding/decoding library involves executing a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2026-122115

A cross-account authorization vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file...

Linux Distros Unpatched Vulnerability : CVE-2026-113356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without...

baserproject baserCMS arbitrary file upload vulnerability

BaserProject baserCMS versions prior to 5.0.0-beta1 and 5.3.2, as well as versions 5.4.0 and 5.4.2, contain an arbitrary file upload vulnerability. This vulnerability arises because PermissionGroupsService::build writes wildcard allow rules when the plugin lacks config/permission.php, allowing th...

Aiven Open PGHoard path traversal vulnerability

Versions of Aiven Open PGHoard prior to 2.7.2 contain a path traversal vulnerability. This flaw stems from incomplete path traversal fixes; attackers with write permissions to the backup object storage can exploit path traversal sequences within specially crafted incremental backup lists. They ca...

Mervin Praison PraisonAI path traversal vulnerability

Versions Mervin Praison PraisonAI from 2.6.0 up to 4.6.59 contain a security vulnerability. This vulnerability arises because the template loader accepts GitHub template URIs containing a “ref” parameter. It fails to normalize user-specified template paths and “refs”, nor does it verify whether t...