Linux Distros Unpatched Vulnerability : CVE-2026-112906

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker...

RockyLinux 8 : python3 (RLSA-2026:85239)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:85239 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verification...

Rocky Linux 9 [CIQ] Security Update: cockpit-files Multiple Vulnerabilities (crlsa-2026_84595)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684595 advisory. cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Local...

Linux Distros Unpatched Vulnerability : CVE-2026-109744

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. CVE-2026-109744...

PT-2026-134536

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...

Linux Distros Unpatched Vulnerability : CVE-2026-112941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .r...

PT-2026-120714

A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save files of the file admin class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack...

PT-2026-120715

A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete folder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The...

Windows Distributed File System Privilege Escalation

The vulnerability of the Windows Distributed File System DFS component in Windows operating systems is related to the use of a non-trusted pointer. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

oretnom23 file-management-system-php input validation error vulnerability

The oretnom23 file-management-system-php has a security vulnerability. This vulnerability stems from improper handling of parameters such as name, parentid, id, type, folderid, and description in the savefolder, deletefolder, deletefile, filerename, and savefiles functions within the adminclass.p...

SvelteKit path traversal vulnerability

SvelteKit has a path traversal vulnerability. This vulnerability stems from a path traversal flaw in the vite preview server on Windows. Unauthenticated attackers can access it over the network or send specially crafted requests via a tunnel, thereby reading files outside the pre-rendered output...

smub Duplicator deserialization injection vulnerability

Smub Duplicator versions 1.5.17 and earlier, as well as Duplicator Pro versions 4.6.10 and earlier, contain a deserialization injection vulnerability. This vulnerability arises because during migration, DUPXUpdateEngine::unserializeTest deserializes untrusted database contents, leading to PHP...

WordPress Mang Board arbitrary file upload vulnerability

WordPress Mang Board versions 2.4.4 and earlier contain an arbitrary file upload vulnerability. This vulnerability arises from the lack of restrictions on allowed file types, enabling web shells to be uploaded to the web server...

PHPOffice PHPPresentation deserialization injection vulnerability

PHPOffice PHPPresentation versions 1.2.0 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unsafe deserialization practices; attackers can exploit it by uploading a ZIP file containing PhpPresentation.xml and passing it to the unserialize function via...

CVE-2025-60479

The GPAC Project/MP4Box software, specifically versions prior to 2.5 , is vulnerable to a NULL pointer dereference within the StatSFVec2f function located in /scene_manager/scene_stats.c. This flaw allows an attacker to trigger a Denial of Service (DoS) condition by providing a crafted MPEG-4 fil...

CVE-2025-60492

A stack overflow in the gfbifsdecnode function /bifs/fielddecode.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-60491

A heap use-after-free vulnerability exists in the dasher_flush_segment function (located in /filters/dasher.c) of GPAC Project/MP4Box versions before 2.5 . This flaw allows an attacker to trigger a Denial of Service (DoS) by providing a crafted MP4 file . While the vulnerability is documented as ...

PT-2026-120477

The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone w...

PT-2026-120567

External control of file name or path and uncontrolled resource consumption in Apache bRPC version 1.18.0 on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privileges of the server process, or to hold the...

PT-2026-120189

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...