CVE-2026-77933 DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQLROOTPASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access...

CLEANSTART-2026-JO14647 CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/ru...

Security vulnerability affects the grafana-alloy package. The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/namespace Thanks to Prasanth...

MLflow FileStore trace IDs allow path traversal and arbitrary file writes

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...

GHSA-WQMH-QCCW-PQWF MLflow FileStore trace IDs allow path traversal and arbitrary file writes

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...

PT-2026-118684

Name of the Vulnerable Software and Affected Versions Issuu Panel plugin for WordPress versions prior to 1.6.6 Description An unauthenticated attacker can include remote or local files through the abspath parameter. This is achieved by sending GET requests to the...

PT-2026-120144

Name of the Vulnerable Software and Affected Versions Imager::File::GIF versions prior to 1.006 Imager affected versions not specified Description An issue exists when consolidating GIF images where palette indices are used without verifying the colour table bounds. Specifically, the i readgif lo...

PT-2026-119046

A segmentation violation in the gf props equal internal function /filter core/filter props.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted data file...

PT-2026-119530

Name of the Vulnerable Software and Affected Versions djust versions 0.9.0 through 1.0.9 djust versions 1.1.0 through 1.1.6 djust versions 1.2.0 through 1.2.3 djust versions 1.3.0rc1 through 1.3.0rc7 Description The find handlers for template MCP tool in python/djust/mcp/server.py accepts an...

PT-2026-118446

Name of the Vulnerable Software and Affected Versions Vitest versions 4.1.11 through 4.1.11 Vitest version 5.0.3 Description In the packages/mocker/src/node/interceptorPlugin.ts file, the isFileLoadingAllowed function and the filesystem read process interpret backslashes differently on Windows. A...

PT-2026-118397

Name of the Vulnerable Software and Affected Versions filelock versions 3.22.0 through 4.2.0 Description In the SoftFileLock implementation, a race condition exists where a stale marker can be broken. This occurs if an attacker frees their own marker after a stale read, and a legitimate contender...

PT-2026-118288

A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system...

PT-2026-118290

A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices...

PT-2026-118310

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query...

PT-2026-118428

Name of the Vulnerable Software and Affected Versions Vite versions prior to 6.4.4 Vite versions prior to 7.3.7 Vite versions prior to 8.1.6 Vite versions prior to 8.2.4 Vite versions prior to 8.3.3 Description Import analysis may record a root-relative browser URL in safeModulePaths instead of t...

VulnCheck KEV: CVE-2014-125134

ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitiv...

VulnCheck KEV: CVE-2014-125133

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve...

PT-2026-118324

UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted...

AlmaLinux 9.2 [TuxCare] Security Update: hplip / hplip-common / hplip-libs / libsane-hpaio Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792490933)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792490933 advisory. - HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software...

Plex Media Server External Control of File Name or Path Vulnerability

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655...

Linux Distros Unpatched Vulnerability : CVE-2026-112390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile...