EUVD-2026-79626

The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. Fixed in 1.6.2. The fix limits access...

CVE-2026-54177

backpack/crud (a Laravel Backpack package for building admin panels) is vulnerable to arbitrary file upload in versions 6.0.0 through 6.8.14 and 7.0.38 . The HasUploadFields trait and FileNameGenerator preserve the client-supplied file extension without rejecting server-executable types. An authe...

CVE-2026-89642

A flaw was found in the Linux kernel's Common Internet File System CIFS implementation. When a client extends a file, the cifssetsize function fails to properly zero out the newly extended portion of the page cache. This oversight can lead to stale data from the client's memory being written back...

AZL-100884 CVE-2026-89642 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecacheisizeextended in cifssetsize when extending cifssetsize calls truncatepagecache but skips pagecacheisizeextended on extension. truncatesetsize shows the correct pattern: isizewriteinode, newsize; if newsize...

UBUNTU-CVE-2026-89614

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

CVE-2026-89642

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecacheisizeextended in cifssetsize when extending cifssetsize calls truncatepagecache but skips pagecacheisizeextended on extension. truncatesetsize shows the correct pattern: isizewriteinode, newsize; if newsize...

CVE-2026-89642 cifs: call pagecache_isize_extended() in cifs_setsize() when extending

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecacheisizeextended in cifssetsize when extending cifssetsize calls truncatepagecache but skips pagecacheisizeextended on extension. truncatesetsize shows the correct pattern: isizewriteinode, newsize; if newsize...

CVE-2026-89642

This vulnerability affects the CIFS filesystem driver in the Linux kernel . The function cifs_setsize() calls truncate_pagecache() when a file is extended but omits the pagecache_isize_extended() call, which is responsible for zeroing the tail of the page that straddles the old end-of-file bounda...

EUVD-2026-76554

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecacheisizeextended in cifssetsize when extending cifssetsize calls truncatepagecache but skips pagecacheisizeextended on extension. truncatesetsize shows the correct pattern: isizewriteinode, newsize; if newsize...

CVE-2026-89642 cifs: call pagecache_isize_extended() in cifs_setsize() when extending

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecacheisizeextended in cifssetsize when extending cifssetsize calls truncatepagecache but skips pagecacheisizeextended on extension. truncatesetsize shows the correct pattern: isizewriteinode, newsize; if newsize...

CVE-2026-89642

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecacheisizeextended in cifssetsize when extending cifssetsize calls truncatepagecache but skips pagecacheisizeextended on extension. truncatesetsize shows the correct pattern: isizewriteinode, newsize; if newsize...

DRUPAL-CONTRIB-2026-153

The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file. The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous...

CVE-2026-85672

zerox 1.1.20 (getomni-ai) is affected by an OS command injection in its file download mechanism. The temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. An attacker can craft a document URL with a malicious file extens...

SUSE CVE-2026-33691

The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions .php, .phar, .jsp, .jspx by inserting whitespace...

reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

CVE-2026-58428

A flaw was found in Gitea. An authenticated remote attacker with repository write permission could bypass the attachment extension allowlist via the web release edit form. This vulnerability allows the attacker to rename existing release attachments to forbidden file extensions, potentially leadi...

PT-2026-80253

Summary HasUploadFields used via CrudTrait on Backpack-managed models and the withFiles uploader preserve the client-supplied file extension without validation. On installations using a public disk with php artisan storage:link, this allows an authenticated administrator to upload a file with a...

EUVD-2026-57264

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-14553

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user Subscriber or higher to upload arbitrary PHP files and achieve remote code execution...

CVE-2026-67206: Unrestricted Upload of File with Dangerous Type

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile and save functions. Attackers with the filemanagermkfile capability...