EUVD-2026-114125

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in readfiledna that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds rea...

EUVD-2026-114124

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumbdataverticalflip. Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write whe...

CVE-2026-119719

Blender versions before 4.5.15 and 5.x before 5.2.3 are vulnerable to a heap buffer overflow within the blend file thumbnail extractor. The root cause is a 32-bit integer overflow in the thumb_data_vertical_flip() function. An attacker can craft a malicious .blend file with specific TEST block di...

CVE-2026-119708 abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context an...

CVE-2026-119708 abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context an...

CVE-2026-119708

The abp-next-admin versions 10.4.0 through 10.7.0 are vulnerable to a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint. This flaw allows authenticated users to access and read files belonging to other tenants by supplying a victim tenantId in the request path. The...

CVE-2026-104066 Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing...

CVE-2026-104065

Scribus versions prior to 1.6.7 are vulnerable to a Heap Out-of-Bounds Write in the importdrw Micrografx Draw plugin. The root cause is an unvalidated y offset used during the selection of image scanlines. An attacker can craft a malicious DRW file that, when imported by a user, writes decoded bi...

CVE-2026-104065 Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Out-of-Bounds Write via Micrografx Draw Import

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap...

CVE-2026-104066 Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing...

CVE-2026-104061 Scribus before 1.6.7 Heap Out-of-Bounds Write via PSD Image Loader

Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloaderpsd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code...

CVE-2025-60500

CVE-2025-60500 — Insecure file upload / logic flaw in QDocs Smart School Smart School 7.1 Publication date: 2025-10-17 Author / Discoverer: Lebas Vivien Status: Reserved CVE: CVE-2025-60500 reserved Summary An insecure file upload / logic flaw in QDocs Smart School — School Management System 7.1...

EUVD-2026-114097

Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloaderpsd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code...

CVE-2022-1388

CVE-2022-1388 Impact This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. There is no data plane exposure; this is a...

CVE-2017-11882-exp

CVE-2017-11882 43b original script from https://github.com/embedi/CVE-2017-11882 109b original script from https://github.com/unamer/CVE-2017-11882/ salute, now unamer's code can execute shellcode CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE...

CVE-2019-6447

CVE-2019-6447 The above investigation of the ES file browser security weakness allows us to see the issue in its entirety...

Security Bulletin: Nomad dispatch payload writes can escape the allocation directory through symlinks

Summary HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on t...

CVE-2026-119147

A flaw was found in ProFTPD. An authorization bypass vulnerability in the modsftp module fails to properly enforce write restrictions when handling file copy requests. An authenticated Secure File Transfer Protocol SFTP user can exploit this issue to copy readable files into write-restricted...

CVE-2024-50473

CVE-2024-50473 Ajar in5 Embed = 3.1.3 - Unauthenticated Arbitrary File Upload Description: The Ajar in5 Embed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 3.1.3. This makes it possible for unauthenticated...

CVE-2025-46822

CVE-2025-46822 Unauthenticated Arbitrary File Read via Absolute Path Description: While Path.resolve method is being used to protect against path traversal I have found that the usage of absolute path successfully read internal files , the endpoint is also not authenticated this means anyone can...