CVE-2026-12264 Authenticated File Write via HA Failover Config Upload leads to RCE

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...

CVE-2026-12264 Authenticated File Write via HA Failover Config Upload leads to RCE

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...

EUVD-2026-88226

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...

CVE-2026-12264

Zohocorp ManageEngine DDI Central versions prior to 6201 are vulnerable to an Arbitrary file write flaw. This vulnerability occurs during the HA Failover Config sync upload process, which can be leveraged by an authenticated user to achieve remote code execution (RCE) . No specific exploit detail...

CVE-2026-19444 Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes

A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on the local machine. If the tar binary ...

CVE-2026-19444 Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes

A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on the local machine. If the tar binary ...

CVE-2026-19444 Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes

A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on the local machine. If the tar binary ...

CVE-2026-19444

A path traversal vulnerability exists in the Kubernetes kubectl client's kubectl cp command on Windows . When copying files from a container, kubectl executes tar inside the container to build an archive. If a malicious tar binary is present in the container, it can emit unexpected output, allowi...

CVE-2026-12269

Zohocorp ManageEngine DDI Central version 6.2.0 (builds below 6201) is vulnerable to a Keepalived configuration injection vulnerability within the HA configuration workflow. An authenticated operator-level user can exploit this flaw to modify the Keepalived configuration, potentially leading to R...

CVE-2026-12269 Authenticated File Write to RCE via keepalived in DDI Central

Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI...

CVE-2026-12269 Authenticated File Write to RCE via keepalived in DDI Central

Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI...

Exploit for Improper Authentication in Openprinting Cups

CVE-2026-34990 — CUPS Local Privilege Escalation PoC A generi...

PT-2026-99857

Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central versions prior to 6201 Description An authenticated arbitrary file write issue exists during the HA Failover Config sync upload process, which can lead to remote code execution. Remote code execution is a type of attac...

dive Arbitrary File Write

dive suffers from an arbitrary file write vulnerability that occurs via a traversal. https://packetstorm.news/download/233044...

CVE-2026-12264: Unrestricted Upload of File with Dangerous Type

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...

PT-2026-99913

WarehousePG WHPG 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability CWE-862 in the built-in server-side file functions pg file writetext,text,bool, pg file renametext,text,text, pg file unlinktext, and pg logdir ls. These functions are executable by any authenticated...

Input Leap Arbitrary File Write

Input Leap versions through 3.0.3 the final release and master, on Windows and macOS, allow a connected peer to write a file outside the configured drop-target directory...

PT-2026-99959

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution RCE. Authentication...

CVE-2026-87798: Improper Link Resolution Before File Access

Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 fixed in 4.0.14, 5.0.10 and 5.21.8 on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary...

Important: runfinch-finch

Issue Overview: A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...