CVE-2025-60496

A Floating-Point Exception FPE in the reframersendpacket function /filters/reframer.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

VulnCheck KEV: CVE-2016-20101

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value...

VulnCheck KEV: CVE-2015-20123

Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile. Attackers can send GET requests to asposedocexporterdownload.php with the 'file' parameter set to...

Red Hat: CVE-2026-92390: curl: curl: -J no-clobber guarantee bypassed with 103 early hints

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

PT-2026-119173

Vulnerability in Oracle Autonomous Health Framework component: Trace File Analyzer. Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise...

PT-2026-118669

Name of the Vulnerable Software and Affected Versions X2000R version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 Description An arbitrary file write issue exists in the boa formUploadFile functionality. An authenticated attacker can send a specially crafted HTTP request to write files to the system,...

PT-2026-118342

LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...

James Charlesworth TinyMCE Thumbnail Gallery path traversal vulnerability

Versions of James Charlesworth TinyMCE Thumbnail Gallery prior to 1.1.0 contain a path traversal vulnerability. This vulnerability stems from improper handling of the href parameter, allowing unauthenticated attackers to read arbitrary files by sending GET requests containing traversal sequences...

VulnCheck KEV: CVE-2016-20103

Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like...

Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read

Summary A lake format that enables building a Realtime Lakehouse Architecture with Flink and Spark for both streaming and batch operations. Innovatively combines lake format and LSM structure, bringing realtime streaming updates into the lake architecture. Description Apache Paimon's MySQL CDC...

Linux Distros Unpatched Vulnerability : CVE-2026-111925

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because...

PT-2026-118385

Name of the Vulnerable Software and Affected Versions filelock versions prior to 4.2.1 Description In UnixFileLock, a regular file renamed onto the lock path can be truncated if another local user possesses rename permissions or if the file is hard-linked under a permissive hard-link policy...

PT-2026-119739

IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type...

PT-2026-118340

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...

PT-2026-118384

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description In the SoftFileLock implementation, a stale observation can be reused. This occurs when an attacker pre-dates and removes their own marker while at least two lock-user processes are waiting. If...

PT-2026-118507

Name of the Vulnerable Software and Affected Versions aaPanel versions prior to 8.25.0 Description An OS command injection issue exists in the File Manager component. The ExecShell function within the class/public/common.py file is susceptible to manipulation via the sfile, dfile, access, and use...

PT-2026-118405

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2 Description The launchEditor function forwards file paths to editors without proper sanitization. If an attacker can create a filesystem entry starting with a plus + or minus - sign in the working...

PT-2026-118627

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description A flaw exists where ViaTemplateActivator. generate only removes existing output if Path.exists is true, which allows a dangling symlink to persist and redirect activation content. Additionally,...

PT-2026-118678

Name of the Vulnerable Software and Affected Versions ChurcHope theme for WordPress versions prior to 2.2 Description A path traversal issue allows unauthenticated attackers to download arbitrary files. This is achieved by supplying directory traversal sequences to the file parameter of the...

PT-2026-118250

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory...