CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

CVE-2026-112820

The Elated-Themes Academist Core WordPress plugin is vulnerable to PHP Local File Inclusion (LFI) due to improper control of filenames in include/require statements. This flaw affects versions up to and including 1.4.1 . While the vulnerability is confirmed, specific exploit details and remediati...

CVE-2026-112820 WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1...

EUVD-2026-108110

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1...

CVE-2026-112820 WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1...

CVE-2026-96293

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file lef...

Virtualenv: Builtin Creation Follows Linked Environment Directories

Summary The builtin creator accepts existing directory symlinks through ensuredir and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as "ANT-2026-MUFJEG11" in "virtualenv-20261015-005", received on 1...

CVE-2026-96293 Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file lef...

CVE-2026-96293 Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file lef...

CVE-2026-96293

WatchGuard Endpoint Security 's Full Disk Encryption feature for macOS contains a cleartext storage vulnerability. The issue arises because the software persistently writes a diagnostic log file that is globally readable by all local users. This allows a local, unprivileged user or process to obt...

EUVD-2026-108073

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file lef...

CVE-2026-112311

The ACF Extended WordPress plugin (versions

CVE-2026-112311 WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7...

CVE-2026-112311 WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7...

cyberpanel-poc

CyberPanel v2.4 — Authenticated Privilege Escalation Chain...

CVE-2026-98684

A flaw was found in the Linux kernel's Server Message Block SMB client. When performing file space allocation operations against certain remote servers, such as Windows servers, the client queries allocated file ranges before flushing recently written data. Because the remote server may report...

CVE-2026-98682

A flaw was found in the Linux kernel's Server Message Block SMB client subsystem. Due to improper synchronization during server-side file copy and clone operations, pending write operations are not drained before copying begins. A local user could exploit this timing issue during copy operations ...

CVE-2026-98681

A flaw was found in the Linux kernel's SMB Server Message Block client. Multiple internal file status flags shared the same memory byte without unified locking, creating a race condition during concurrent file operations. A local user performing simultaneous file operations could cause updates to...

CVE-2026-16648

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7...

Pulse Connect Secure SSL VPN Arbitrary File Read

Pulse Secure Pulse Connect Secure PCS 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 all contain an arbitrary file reading vulnerability that could allow unauthenticated remote attackers to send a specially crafted URI to gain improper access. id: CVE-2019-11510 info: name: Pulse...