PT-2026-57445

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-26 Description A policy bypass exists in the APNG encoder and external delegates caused by missing validation checks. This allows attackers to bypass configured policy restrictions during the APNG encoding...

CVE-2026-14480

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename progfile directly into the Programs.File database field and later uses this value as the destination path for an...

CVE-2026-14480

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename progfile directly into the Programs.File database field and later uses this value as the destination path for an...

CVE-2026-14480

CVE-2026-14480 affects OpenPLC Runtime v3. An authenticated user can write arbitrary files via the legacy web UI program-upload workflow by storing a attacker-controlled filename (prog_file) that is later used as the destination path. Python os.path.join() honors absolute paths, enabling writes a...

CVE-2026-14480 OpenPLC v3 External Control of File Name or Path

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename progfile directly into the Programs.File database field and later uses this value as the destination path for an...

CVE-2026-14480 OpenPLC v3 External Control of File Name or Path

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename progfile directly into the Programs.File database field and later uses this value as the destination path for an...

CVE-2026-58499 Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id

EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint because the per-message senderid field was not validated as a path-safe identifier, unlike appid and projectid. During user-memory extraction, senderid i...

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

Joomla Helix3 <= 3.1.1 - Unauthenticated Arbitrary File Write (CVE-2026-49049)

CVE-2026-49049 in JoomShaper Helix3 = 3.1.1: unauthenticated file write via comajax helix3 save path traversal in layoutName, arbitrary file delete via remove, and template parameter overwrite via import Helix3 v3.x. The save action always appends .json — no reliable shell; use for authorized fil...

Joomla Helix3 CVE-2026-49049 (unauthenticated file write) detection

Detects JoomShaper Helix3 = 3.1.1 affected by CVE-2026-49049: unauthenticated arbitrary file write/delete and template parameter overwrite via the comajax helix3 plugin handler. !/usr/bin/env python3 -- coding: utf-8 -- import json import random import string from kittysploit import from...

CVE-2026-53449

CVE-2026-53449 — Coturn : Before 4.13.0, the psd print sessions dump CLI command accepts a filename argument and passes it directly to fopen without path validation, enabling an authenticated admin with CLI access to overwrite arbitrary files writable by the coturn process with session dump data....

CVE-2026-53449 Coturn: Arbitrary File Write via CLI psd Command

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable ...

CVE-2026-53449 Coturn: Arbitrary File Write via CLI psd Command

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable ...

CVE-2026-53449 Coturn: Arbitrary File Write via CLI psd Command

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable ...

CVE-2026-60089

Prais onAI (pip package praisonaiagents) prior to version 1.6.78 is affected by a path-traversal issue: defaults loaded from a project-local .praisonai/config.toml can set defaults.output.output_file to an absolute or .. traversal path. If an Agent is started without an explicit output parameter,...

Cisco CUCM CVE-2026-20230 SSRF to arbitrary file write RCE

CVE-2026-20230 chains SSRF via /cmplatform/installClusterStatusExecute, Axis LogHandler arbitrary file write, and JSP webshell deployment to obtain remote command execution on Cisco Unified Communications Manager 15.0.1.13901-2. Opens an interactive HTTP command shell and optionally dispatches th...

Cisco CUCM CVE-2026-20230 detection

Detects Cisco Unified Communications Manager instances exposing the webdialer WSDL endpoint used in CVE-2026-20230 SSRF to arbitrary file write and JSP command execution. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient import Httpclie...

Adobe ColdFusion RDS path traversal RCE (CVE-2026-48282)

CVE-2026-48282: Adobe ColdFusion Remote Development Service RDS exposes /CFIDE/main/ide.cfm without authentication on affected builds. Path traversal allows arbitrary file read/write and CFML webshell deployment for remote code execution. Affected: ColdFusion 2025 = Update 9, ColdFusion 2023 =...