Low: file-roller

Issue Overview: A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a...

PT-2026-133440

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to...

PT-2026-133620

Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing...

CVE-2026-104065: Scribus: Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an…

Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing...

CVE-2026-116245: pgadmin.org pgAdmin 4: libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry…

libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server's Service, or a "service" connection parameter, to one of tho...

CVE-2026-116250: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with…

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with checkaccesspermission and then opened it by name. Several places opened it with a plain open or handed the path to a utility that opened it later: the servers.json export and import and the import fi...

CVE-2026-116242: pgadmin.org pgAdmin 4: pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file,…

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither hostpkeydirectories nor sshconfigfile, so it always loaded the unencrypted private keys in /.ssh of the operating-system account running pgAdmin, read that account's /.ssh/config IdentityFile, User, HostName, ProxyCommand...

CVE-2026-115346: ThemeFusion Avada | Website Builder For WordPress & WooCommerce: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in…

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded files. This mak...

PT-2026-133448

Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 242 in version 10.02.002...

CVE-2026-115604: Brainstorm Force SureDash: Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.

Subscriber Arbitrary File Deletion in SureDash = 1.12.3 versions...

PT-2026-133656

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read struct that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer...

CVE-2026-119722: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that…

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in readstruct that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer...

CVE-2026-119720: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that…

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in readfiledna that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds rea...

PT-2026-133654

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read file dna that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds...

PT-2026-133653

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb data vertical flip. Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write...

PT-2026-133667

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository,...

CVE-2026-119298: schollz croc: croc is a tool that allows any two computers to simply and securely transfer files and folders

croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact even when SendingText is...

CVE-2026-61738: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, POST /api/scoutsuite/generate-gcp-report in backend/app/integrations/scoutsuite/routes/scoutsuite.py admits admin and analyst users and validates the uploaded content as...

PT-2026-133610

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, POST /api/scoutsuite/generate-gcp-report in backend/app/integrations/scoutsuite/routes/scoutsuite.py admits admin and analyst users and validates the uploaded content as...

PT-2026-133598

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, POST /api/agent data store/upload in backend/app/data store/data store routes.py permits customer user callers to choose bucket name and object name without an allowlist, tenan...