PT-2026-115218

Name of the Vulnerable Software and Affected Versions BeyondTrust Remote Support versions prior to 26.2.3 Description Internal messaging components of the product fail to adequately validate the origin of received messages. This improper origin validation allows an unauthenticated remote attacker...

CVE-2026-102764: Authentication Bypass by Spoofing

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance...

CVE-2026-55376

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/pythontoolexecutor.py becau...

CVE-2026-55376 heym Python Tool Sandbox Escape

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/pythontoolexecutor.py becau...

CVE-2026-55376

Prior to version 0.0.40 , the heym platform is vulnerable to a sandbox escape within the backend/app/services/python_tool_executor.py component. An authenticated user capable of creating or editing a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox. The root cause ...

CVE-2026-55376 heym Python Tool Sandbox Escape

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/pythontoolexecutor.py becau...

Log4Jolokia

Log4Jolokia Descrizione: Implementazione Python3 per sfruttare gli MBean di Log4J tramite Jolokia Utilizzo: Aiuto generico: usage: log4jolokia.py -h -u USER -p PASSWD --proxy PROXY -H HEADER execjar,writefile,readfile,execscript execjar,writefile,readfile,execscript ... target target ... position...

CVE-2026-93320

A flaw was found in BuildKit. This vulnerability allows an attacker to trick the build engine into performing file operations on special file inodes where regular files are expected. By providing a crafted build context, an attacker can block build operations leading to a Denial of Service DoS or...

CVE-2026-92820

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...

CVE-2026-92820 Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...

CVE-2026-92820

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to and including 3.3.34 . The root cause is that the plugin trusts an attacker-supplied file path from form submissions during the External File Upload (Amazon S3) flow. This unvalida...

EUVD-2026-91175

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...

PT-2026-104083

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's file path,...

CVE-2026-97662

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to...

CVE-2026-103754

A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...

CVE-2026-97662: Improper Neutralization of Argument Delimiters in a Command

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to...

PT-2026-103965

Name of the Vulnerable Software and Affected Versions AWS security-agent-mcp-server versions prior to 0.2.0 Description An argument injection issue exists in the diff scan operation. A threat actor can provide a crafted reference value to the diff scan operation to create, overwrite, or truncate...

Rocky Linux 9 [CIQ] Security Update: perl / perl-Attribute-Handlers / perl-AutoLoader / perl-AutoSplit / etc (crlsa-2025_11804)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202511804 advisory. perl: Perl threads have a working directory race condition where file operations may target unintended paths CVE-2025-40909 Tenable has extracted the preceding...

Rocky Linux 10.0 [CIQ] Security Update: perl / perl-Attribute-Handlers / perl-AutoLoader / perl-AutoSplit / etc (crlsa-2025_12056)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202512056 advisory. perl: Perl threads have a working directory race condition where file operations may target unintended paths CVE-2025-40909 Tenable has extracted the preceding...

CVE-2026-92371

TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording CSR functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged...