ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE)

ZZZCMS zzzphp v1.6.3 contains a remote code execution caused by lack of restrictions in inc/zzzfile.php, letting attackers execute arbitrary PHP code via a crafted URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter, exploit requires attacker to send malicious URL and...

CVE-2026-53802

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

CVE-2026-53802 rsync < 3.5.0 Arbitrary File Read via Symlink Following

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

GHSA-5XVQ-CP9X-6P6R vulnerabilities

Vulnerabilities for packages: yazi...

Security update for libarchive

This update for libarchive fixes the following issues: creating temporary files in the current working directory instead of the target directory can lead to file creation failures when the working directory is not writable bsc1254340. file descriptor leak in the mtree parser cleanup path could le...

CVE-2026-19089

The CVE-2026-19089 entry concerns the Product Input Fields for WooCommerce WordPress plugin prior to 2.0.2. The vulnerability is that the plugin does not validate uploaded file types when the accepted-types setting is empty, which the documentation claims allows all files. This permits unauthenti...

Important: Red Hat Security Advisory: perl-Archive-Tar security update

An update for perl-Archive-Tar is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

CVE-2026-10700 Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files

IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user files.The /api/v1/files/images/flowid/filename endpoint does not enforce authentication or authorization checks, allowing unauthenticated...

Adobe Bridge out-of-bounds write vulnerability

Adobe Bridge is a digital asset management and file organization tool developed by the American company Adobe. Adobe Bridge has a out-of-bounds write vulnerability, which allows attackers to execute arbitrary code within the context of the current user...

PT-2026-66536

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.8.4 Description Broken access control issues in the file handling API allow unauthorized access to user files, breaking tenant isolation in multi-user deployments. The endpoint '/api/v1/files/images/fl...

TencentOS Server 4: vim (TSSA-2026:0674)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0674 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

SUSE CVE-2026-64426

In the Linux kernel, the following vulnerability has been resolved: iouring/nop: fix file reference leak with IOSQEFIXEDFILE NOP file-acquisition support choses between a fixed registered file and a normal fget'd file based on its own IORINGNOPFIXEDFILE flag in sqe-nopflags. However, a request's...

Updated perl-Config-IniFiles package fixes a security vulnerability

The updated package fixes a security vulnerability: Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle. CVE-2026-11527...

OPENSUSE-SU-2026:21371-1 Security update for gzip

This update for gzip fixes the following issue - CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the user's PATH bsc1269622...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Vim vulnerabilities (USN-8541-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8541-1 advisory. Hirohito Higashi discovered that Vim incorrectly escaped class or trait names whe...

CVE-2026-13001

Affected software : Podlove Podcast Publisher for WordPress. Vulnerability : arbitrary file uploads caused by missing file type validation in the podlove_handle_cache_files function, affecting all versions up to and including 4.5.1. Impact : unauthenticated attackers could upload arbitrary files ...

OPENSUSE-SU-2026:21319-1 Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2025-61732: cmd/cgo: discrepancy between Go and C/C++ comment parsing allows for C code smuggling bsc1257692. - CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session...

CVE-2026-48127

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-handling API endpoints such as addattachments. This issue is fixed in versions 16.20.0 and 15.110.0...

EUVD-2026-42686

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This is due to insufficient validation of file-field values in the UsersWPValidation::validatefields function which falls through to sanitizetextfield for fields of type 'file',...

OESA-2026-2905 vim security update

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Securi...