CVE-2026-89286: Exposure of Sensitive Information to an Unauthorized Actor

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...

CVE-2026-91047: Missing Authorization

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file...

CVE-2026-79985: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel SMB component. This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolut...

CVE-2026-79983: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel FTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolut...

CVE-2026-111829: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0...

PT-2026-117310

Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials. Use...

PT-2026-117392

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0...

PT-2026-117397

NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing...

Important: python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Moderate: cockpit-files security update

A filesystem browser for Cockpit Security Fixes: cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race CVE-2026-91205 For more details about the...

RHEL 9 : cockpit-files (RHSA-2026:84595)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:84595 advisory. A filesystem browser for Cockpit Security Fixes: cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in...

CVE-2025-60482

The GPAC Project/MP4Box version 2.5-DEV-rev1593-gfe88c3545-master contains a heap use-after-free vulnerability in the gf_odf_ac4_cfg_clean_list function located in /odf/descriptors.c. This flaw allows an attacker to trigger a Denial of Service (DoS) by providing a crafted AC4 file . While the vul...

CVE-2025-55667

The GPAC MP4Box software (version v2.5-DEV-rev1672-gc9a31d0e1-master ) is vulnerable to a segmentation violation within the dump_isom_saps function located in /mp4box/filedump.c. This flaw allows an attacker to trigger a Denial of Service (DoS) by providing a crafted MP4 file . The vulnerability ...

EUVD-2025-211131

A use-after-free in the gffilterpidgetpacket function filtercore/filterpid.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted file...

CVE-2025-55654

A use-after-free in the gffilterpidgetpacket function filtercore/filterpid.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted file...

CVE-2025-55667

A segmentation violation in the dumpisomsaps function /mp4box/filedump.c of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

EUVD-2025-211133

A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

PT-2026-117337

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description An improper limitation of a pathname to a restricted directory, known as Path Traversal, exists in the Apache Camel Azure Files component. The...

CVE-2025-55667

A segmentation violation in the dumpisomsaps function /mp4box/filedump.c of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2026-79984: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel Mina SFTP component. This issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the...