CVE-2026-56702

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

phpMyFAQ Unauthorized Access

The vulnerability of the phpMyFAQ web interface is related to insecure temporary files. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Linux X86 device support driver Function Use-After-Free

The vulnerability of the currentvaluestore function in the drivers/platform/x86/think-lmi.c module of the Linux kernel’s X86 device support driver lies in the fact that authentication data is stored in configuration files in an unencrypted form. Exploiting this vulnerability could allow an attack...

nginx:1.26 security update

1.26.3-9.0.1.3 - Require oracle-indexhtml 2:1.26.3-13 - Fixes CVE-2026-56434 and CVE-2026-60005 2:1.26.3-12 - Resolves: RHEL-191774 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes 2:1.26.3-11 - nginx:1.26/nginx: HTTP/2: Remote Denial of Service via compression bomb and...

PT-2026-81496

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description The exrmultiview utility can perform a heap out-of-bounds write when combining two valid scanline EXR files if the union...

PT-2026-81518

Name of the Vulnerable Software and Affected Versions SonicWall NetExtender Linux client affected versions not specified Description The NEService auto-upgrade process insecurely handles temporary files, which allows an attacker to manipulate file paths. Recommendations At the moment, there is no...

CVE-2026-79781: Improper Limitation of a Pathname to a Restricted Directory

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

PT-2026-82043

It was discovered that Vim incorrectly handled certain tags files. An attacker could possibly use this issue to execute arbitrary code...

CVE-2026-79781: Improper Limitation of a Pathname to a Restricted Directory

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

PT-2026-85183

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe git revision options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame. Attackers can supply revision values like --contents=/etc/passwd to lea...

CVE-2026-55530: Missing Authorization

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, astgreprewrite lacks the @requireapproval decorator used by sibling mutation tools. With dryrun=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected...

CVE-2026-71507

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

CVE-2026-60093

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

CVE-2026-77914

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal...

CVE-2026-78269

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

CVE-2026-78269 WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

CVE-2026-78269 WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

EUVD-2026-64834

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

CVE-2026-78269

CVE-2026-78269 is a Server Side Request Forgery (SSRF) vulnerability in the WordPress Shared Files plugin (versions

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: NTFS: Makes system files immutable to prevent corruption. When a system file such as $Bitmap is exposed via showsysfiles and written from user space, the volume becomes corrupted. Since the cluster allocator scans $Bitmap...