Astra Linux – vulnerability in dovecot

When Dovecot has been configured to use per-domain passwd files, and these files are located one path component above /etc, or if slashes have been added to the allowed characters, path traversal may occur when the domain component is a directory path. This can inadvertently lead to reading...

Astra Linux – vulnerability in openssh

OpenSSH’s SCP prior to version 10.4 may place a file in the parent directory of the intended directory when a copy is performed between two remote destinations...

Astra Linux – vulnerability in lxml

Lxml is a library for processing XML and HTML in Python. Prior to version 6.1.0, using either of the two parsers with the default configuration with resolveentities=True allowed untrusted XML input to read local files. Setting the resolveentities option explicitly to resolveentities='internal' or...

Astra Linux – vulnerability in tar

GNU Tar version 1.35 allows file overwriting via directory traversal in specially crafted TAR archives, following a specific two-step process. First, the victim must extract an archive containing a ../ symlink pointing to a critical directory. Second, the victim must then extract another archive...

Astra Linux – vulnerability in freerdp3

FreeRDP versions prior to 3.29.0 fail to properly validate server-supplied RDPDR paths during drive redirection, enabling attackers to access prefix-sibling paths outside the configured shared root. A malicious RDP server can read, write, delete, and enumerate files in sibling directories by...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attrsetsize errors when truncating files If attrsetsize fails during file truncation, the error is silently ignored and the inode may remain in an inconsistent state...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: add seqadj extension for natted connections Sequence adjustment may be required for FTP traffic with PASV/EPSV modes. Due to the need to rewrite the packet payload IP, port on the ftp control connection. This ca...

Astra Linux – vulnerability in Perl

IO::Compress versions prior to 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. parseOutputGlob wraps the caller-supplied output glob string in double quotes and stores it in the parser state; getFiles then runs the stored expression through ev...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix cred ref leak in nfsdnlthreadssetdoit. SyZBot reported a memory leak related to struct cred. 0 nfsdnlthreadssetdoit passes getcurrentcred to nfsdsvc, but putcred is not called afterward. The cred is ultimately passed to...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix use-after-free in ksmbdclosefd via a durable scavenger When a durable file handle persists after a session disconnect TCP close without SMB2LOGOFF, sessionfdcheck sets fp-conn = NULL to retain the handle for subsequent...

Astra Linux – vulnerability in vim

Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow existed in readcompound within src/spellfile.c when loading a specially crafted spell file .spl with UTF-8 encoding enabled. An attacker-controlled length field in the spell file’s compound section...

Astra Linux – vulnerability in gzip

GNU gzip contains a vulnerability in the gzexe utility related to insecure handling of temporary files. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path solely based on the process ID PID. This predictable filename is created...

mariadb: MariaDB: Unauthorized file access via CONNECT engine functions

A flaw was found in MariaDB. Certain file-access User-Defined Functions UDFs within the CONNECT storage engine do not properly enforce user privileges or directory restrictions when handling file system paths. An authenticated, low-privileged database user can exploit this vulnerability to read...

CVE-2026-89286

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...

CVE-2026-91047

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file...

CVE-2026-108120

Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the...

mariadb: MariaDB: Unauthorized file access via CONNECT engine functions

A flaw was found in MariaDB. Certain file-access User-Defined Functions UDFs within the CONNECT storage engine do not properly enforce user privileges or directory restrictions when handling file system paths. An authenticated, low-privileged database user can exploit this vulnerability to read...

CVE-2026-89286

The FormFlow for GoHighLevel (GHL) WordPress plugin (versions through 1.0.0 ) is vulnerable to unauthenticated sensitive data disclosure. The application fails to restrict access to a log file stored within a publicly accessible uploads directory . An attacker can read this file to obtain connect...

CVE-2026-89286 FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...

CVE-2026-89286 FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...