CVE-2026-75865 WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

CVE-2026-75865 WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

CVE-2026-16601

CM Map Locations for WordPress (all versions ≤ 2.1.8 ) is vulnerable to limited arbitrary file upload via the cmloc_route_image_upload AJAX action. The uploadMedia function performs incomplete extension filtering without MIME-type checks or upload capability verification before calling move_uploa...

CVE-2026-2334 ) Missing Server-Side File Extension Validation in vsDesk

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

EUVD-2026-63217

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...

CVE-2026-14946 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious configuration file.

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...

CVE-2026-15049

The Depicter — Popup & Slider Builder WordPress plugin (versions before 4.8.0 ) contains an arbitrary file upload vulnerability. The root cause is a failure to validate the type of files uploaded via the import feature and a failure to remove malformed uploads. This allows users with editor-level...

CVE-2026-68899

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile silently returned undefined when that binary was unavailable and the validation fell back to the...

CVE-2026-73373

Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

CVE-2026-49986 Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`

The Cortex MCP server neuro-cortex-memory, a cross-platform persistent memory MCP, prior to version 3.17.1 treats the CLAUDEPROJECTDIR environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout. When the openvisualizati...

EUVD-2026-57082

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

[SECURITY] [DSA 6425-1] openjdk-21 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6425-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 10, 2026 https://www.debian.org/security/faq -...

CVE-2026-71434

CVE-2026-71434 affects Statamic (Laravel/Git-based CMS). Before version 5.74.3 and 6.24.2, public frontend forms did not enforce file upload restrictions that the Control Panel enforces, allowing an unauthenticated visitor to upload file types administrators disallow via assets/files fields. For ...

CVE-2026-70603

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...

CVE-2026-6147

The LightSync Pro WordPress plugin is affected by an insecure file upload vulnerability due to missing file type validation in rest_replace_media() in all versions up to and including 2.1.6. The flaw allows authenticated attackers with Author-level access or higher to upload arbitrary files on th...

CVE-2026-6147 LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

CVE-2026-16548

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an...

CVE-2026-64816

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

CVE-2026-1771

The MapSVG WordPress plugin is affected up to version 8.14.0. The vulnerability stems from missing file type validation in the SVGFile constructor (due to an incorrect conditional check), allowing authenticated attackers with Administrator+ access to upload arbitrary files via the SVGFile upload ...

CVE-2026-1771 MapSVG <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible...