CVE-2026-73373 Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

CVE-2026-73373

Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

GO-2026-6247 uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability in gitlab.com/uniget-org/cli

uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability in gitlab.com/uniget-org/cli...

CVE-2026-75832

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

CVE-2026-14610

A flaw was found in Open Asset Import Library Assimp. This vulnerability, a heap-based buffer overflow, allows a local attacker to manipulate input when processing CSM files. Successful exploitation could lead to information disclosure, compromise of data integrity, or a denial of service DoS...

XML External Entity (XXE)

Ambari/Oozie is vulnerable to an XML External Entity XXE. The vulnerability is due to insecure XML parsing using DocumentBuilderFactory without disabling external entity resolution, which allows an attacker to inject malicious XML entities and exploit the application to read arbitrary files from...

EUVD-2026-60543

Mattermost Desktop App versions =6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the...

SUSE CVE-2026-53800

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink...

SUSE CVE-2026-70461

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

PT-2026-80356

OpenList: Authenticated users can rename files outside their base path via batch rename src name traversal in github.com/OpenListTeam/OpenList...

PT-2026-80400

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings...

CVE-2026-75832: Missing Authorization

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

PT-2026-80350

Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored in github.com/cloudreve/Cloudreve...

CVE-2026-53453: Missing Authorization

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

PT-2026-80453

Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands in github.com/kubev2v/migration-planner...

PT-2026-80464

uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability in gitlab.com/uniget-org/cli...

PT-2026-80763

Name of the Vulnerable Software and Affected Versions resdata versions prior to 6.2.9 Description The software fails to correctly validate input within GRDECL files. This issue is particularly critical when the tool is used to parse untrusted files in networking contexts, such as webservices...

PT-2026-80309

Impact Prior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer overflow . The severity rating assumes that surfio is used to parse untrused files in a networking context such as a web service. Patches The bug has been patched in version 0.0.19...

PT-2026-80764

Name of the Vulnerable Software and Affected Versions surfio versions prior to 0.0.19 Description Insufficient validation of size fields in irap files leads to a buffer overflow, which occurs when a program writes more data to a block of memory than it can hold. This issue is particularly critica...

Linux Distros Unpatched Vulnerability : CVE-2026-74362

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ext2: fix ignored return value of genericwritesync Fix ext2diowriteiter to propagate the error returned by genericwritesync instead of silently discarding it,...