cups: cups: Arbitrary file overwrite via insecure temporary file handling

A flaw was found in CUPS. Insecure temporary file handling allows a local attacker with print administrative privileges to overwrite arbitrary system files. When configuring a printer, the print service creates a temporary file with a predictable name in a shared directory without verifying wheth...

Netcore NR256CN Authorization Issue Vulnerability

Netcore NR256CN versions 1.5.140116 and earlier have an authorization issue vulnerability. This vulnerability stems from an unvalidated file writing vulnerability in the /bin/boa web server, derived from Boa. Attackers can send POST requests to non-existent .cgi paths, thereby writing...

Hrisikesh Pal Blood_Bank_Management_System Cross-site Scripting Vulnerability

Hrisikesh Pal BloodBankManagementSystem 1.0.0 has a security vulnerability. This vulnerability stems from incorrect handling of parameters in the Search field within the file/abs.php, which may lead to cross-site scripting attacks...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.13 contains a security vulnerability. This vulnerability arises from the use of an invalid pstate pointer after the nvkmclkustateupdate function does not hit a break in the listforeachentry loop. In user space, it is possible to request an non-existent pstate ID through...

Omnigent path traversal vulnerability

In versions prior to Omnigent 0.14.0 and 0.3.0, there was a path traversal vulnerability. This vulnerability stems from path traversal attacks. Certified users can escape the working directory by setting up nested sub-proxies in os.env.cwd. They can also upload bundles that utilize absolute or...

Linux Kernel Security Vulnerabilities

The Linux kernel versions from 6.1.68 up to 6.2, as well as from 6.6.7 up to 6.7, have security vulnerabilities. These vulnerabilities stem from cloned paths in the smb client’s cifsfilecopychunkrange and cifsremapfilerange functions. These cloned paths are not emptied or invalidated before being...

Grigory Chudov’s buffer error vulnerability

Grigory Chudov’s libtta versions 2.3 and earlier have a buffer error vulnerability. This vulnerability arises from the lack of header checks that reject zero audio channels. An attacker can create a specially crafted .tta file that declares zero audio channels, causing the application to access...

WordPress Advanced File Manager Authorization Issue Vulnerability

WordPress Advanced File Manager versions 5.4.14 and earlier have a licensing issue vulnerability. This vulnerability stems from the lack of authorization, allowing exploitation through incorrectly configured access control levels...

CVE-2025-52691-PoC-SmarterMail-authentication-bypass-exploit-WT-2026-0001

CVE-2025-52691 / WT-2026-0001 SmarterMail Exploit 🚨 IMPORTANT NOTICE This tool is for authorized security testing and educational purposes only! Unauthorized use is illegal and unethical Only use on systems with explicit authorization Use at your own risk Users are responsible for compliance with...

CLSA-2026-1792238279 ghostscript: Fix of 6 CVEs

CVE-2023-28879: fix buffer overrun in TBCP encoding - CVE-2023-38559: fix out-of-bounds read in devnpcxwriterle - CVE-2023-46751: fix dangling file pointer in gdevprnopenprinterseekable - CVE-2024-46951: check the type of the Pattern Implementation - CVE-2024-46953: check for overflow validating...

WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by hhhai in WordPress Plugin MapSVG versions = 8.16.1...

WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Peter Tang in WordPress Plugin MapSVG versions = 8.16.1...

CVE-2026-110253

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

EUVD-2026-103278

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

CVE-2026-110253 weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

CVE-2026-110253 weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

CVE-2026-110253

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin is vulnerable to limited media file deletion in versions up to and including 1.6.28 . The root cause is insufficient file path validation within the weforms_delete_entry_attachments function. This allows unauthenticated atta...

WordPress weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin <= 1.6.28 - Unauthenticated Limited Media File Deletion vulnerability

Unauthenticated Limited Media File Deletion vulnerability discovered by Kuba in WordPress Plugin weForms versions = 1.6.28...

CVE-2026-104246

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

CVE-2026-104246

The Contact Form 7 Signature Addon WordPress plugin (versions through 4.2.2 ) is vulnerable to an unauthenticated arbitrary file read via path traversal . The root cause is the lack of sanitization for a signature field value when building an email attachment path. An attacker can attach arbitrar...