Totolink X2000R boa formUploadFile arbitrary file write vulnerability

Summary A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

PT-2026-117951

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL ROOT PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database acce...

AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792411096)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792411096 advisory. - The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web...

Plex Media Server < 1.43.3.10861 Multiple Vulnerabilities

According to its self-reported version, the Plex Media Server installed on the remote host is prior to 1.43.3.10861. It is, therefore, affected by multiple vulnerabilities: - Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The...

MariaDB 10.6.0 < 10.6.28/ 10.11.0 < 10.11.19/ 11.4.0 < 11.4.13/ 11.8.0 < 11.8.9/ 12.3.0 < 12.3.3/ 13.0.0 < 13.0.2

The version of MariaDB installed on the remote host is prior to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2. It is, therefore, affected by a vulnerability as referenced in the GHSA-m5gf-432r-g5jw advisory. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until...

AlmaLinux 10 : gd (ALSA-2026:81518)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:81518 advisory. libgd: buffer overflow when processing specially crafted GIF file CVE-2026-9672 Tenable has extracted the preceding description block directly from the AlmaLinux...

Linux Distros Unpatched Vulnerability : CVE-2026-112405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge can dereference a null image8 plane. Validation skips the first input band,...

CentOS Linux 7 [TuxCare] Security Update: python3 / python3-debug / python3-devel / python3-idle / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791896121)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1791896121 advisory. - tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored...

CentOS Linux 7 [TuxCare] Security Update: python / python-debug / python-devel / python-libs / python-test / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791485785)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1791485785 advisory. - tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored...

SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:4738-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:4738-1 advisory. This update for python fixes the following issue: - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic...

Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read

Apache Paimon versions 2.1.0 and 2.0.0 MySQL CDC synchronization actions allow user-supplied JDBC properties that can enable a rogue MySQL server to request arbitrary local files from the CDC process. !/usr/bin/env bash Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read Vendor: The Apache Software...

PT-2026-118479

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...

PT-2026-118688

A Floating-Point Exception FPE in the reframer send packet function /filters/reframer.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-118680

Name of the Vulnerable Software and Affected Versions Aspose Importer & Exporter plugin for WordPress versions prior to 3.0 Description A path traversal issue allows unauthenticated attackers to download arbitrary files. This occurs because the file parameter is not properly sanitized. Attackers...

PT-2026-118681

Name of the Vulnerable Software and Affected Versions Aspose PDF Exporter plugin for WordPress versions prior to 2.0 Description An issue exists where unauthenticated attackers can download files by exploiting a path traversal flaw. This occurs because the file parameter passed to the readfile...

PT-2026-118679

Name of the Vulnerable Software and Affected Versions Aspose Doc Exporter plugin for WordPress versions prior to 2.0 Description An issue allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to the readfile function. This is achieved by sending GET requests to...

CVE-2014-125133: Improper Limitation of a Pathname to a Restricted Directory

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve...

PT-2026-118402

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .rw lock tree and resolve its names again during later record operations. This behavior allows a local user to repla...

CVE-2016-20103: Improper Limitation of a Pathname to a Restricted Directory

Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like...

CVE-2025-60496

A Floating-Point Exception FPE in the reframersendpacket function /filters/reframer.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...