CVE-2026-104061: Scribus: Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap out-of-bounds write vulnerability in the…

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap out-of-bounds write vulnerability in the scimgdataloaderpsd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes an...

PT-2026-134198

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized...

PT-2026-133728

A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move uploaded file of the file admin/add logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack...

PT-2026-134228

Name of the Vulnerable Software and Affected Versions Refitter versions prior to 2.1.1 Description The refitter dotnet tool uses NJsonSchema with unsafe defaults for $ref resolution when generating Refit interfaces and contracts from OpenAPI descriptions. If an attacker controls or influences the...

PT-2026-134197

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses...

PT-2026-134231

Name of the Vulnerable Software and Affected Versions sevenz-rust2 versions prior to 0.21.1 Description Extracting a malicious 7z archive allows writing or overwriting files outside the intended destination directory. In src/util/decompress.rs, the decompress impl function calculates the...

PT-2026-133620

Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing...

PT-2026-133453

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are...

CVE-2026-119334: pi-hole: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a...

CVE-2026-97209: elixir-lang elixir: Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another…

Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under th...

PT-2026-133614

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require once. Attackers can supply path traversal sequences ../../ to include...

PT-2026-133731

Name of the Vulnerable Software and Affected Versions LM Studio versions prior to 0.4.22+1 Description A path traversal issue exists in the model downloader's resolveDownloadRequest function. This allows attackers to write files outside the designated models directory by using backslash-separated...

PT-2026-133440

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to...

CVE-2026-115604: Brainstorm Force SureDash: Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.

Subscriber Arbitrary File Deletion in SureDash = 1.12.3 versions...

PT-2026-133448

Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 242 in version 10.02.002...

PT-2026-134414

Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted db values direct...

CVE-2026-118561: Drupal Single Content Sync: External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

RHEL 9 : mrtg (RHSA-2026:92071)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:92071 advisory. The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provid...

RHEL 8 : mrtg (RHSA-2026:91845)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:91845 advisory. The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provid...

RockyLinux 9 : aspell (RLSA-2026:92458)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:92458 advisory. aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 Tenable has extracted the preceding description block directly from the...